From d006ae3d86e21b24228d7c3f88f7c4b2c1a6be69 Mon Sep 17 00:00:00 2001 From: "Sam (automated drift fix)" Date: Wed, 14 Oct 2026 14:44:00 +0300 Subject: [PATCH] docs(ai-gateway): tighten authentication wording Split the service role bullet into short sentences, simplify the token field description so it no longer contradicts the user authentication bullet, and add the paragraph on what the mode does and doesn't change. Co-Authored-By: Claude Sonnet 5.5 --- packages/sdk/src/modules/ai-gateway.types.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/packages/sdk/src/modules/ai-gateway.types.ts b/packages/sdk/src/modules/ai-gateway.types.ts index 0585a97..4c0684e 100644 --- a/packages/sdk/src/modules/ai-gateway.types.ts +++ b/packages/sdk/src/modules/ai-gateway.types.ts @@ -5,9 +5,7 @@ export interface AiGatewayConnection { /** Base URL of the selected gateway provider. */ baseURL: string; /** - * Bearer token that authenticates the request: the service-role token from - * `base44.asServiceRole.aiGateway`, or the signed-in user's token from - * `base44.aiGateway`. The gateway expects the service-role token. + * Bearer token that authenticates the request. The mode you call `connection()` from determines whose token it is. */ token: string; /** @@ -95,9 +93,15 @@ export interface AiGatewayModuleConfig { * * The mode determines which token `connection()` returns: * - * - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the app's service-role token. Use it server-side; the gateway rejects other calls with a `403` and the error code `ai_gateway_requires_service_role`. It also works with no signed-in user, such as from a scheduled automation. + * - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the app's service-role token. Use it server-side. Calls from the browser or with a user's token get a `403` and the error code `ai_gateway_requires_service_role`. It also works when no user is signed in, such as from a scheduled automation. * - **User authentication** (`base44.aiGateway`): Returns the signed-in app user's token. The gateway accepts it only on apps shared privately or with your workspace. * + * The mode decides which token you get and whether the gateway accepts the call. + * It grants the model no extra reach, because the gateway runs a model and never + * touches your data. Access to your app's data comes from the `base44.entities` + * calls you write around the gateway call, so pick the mode for those on their + * own merits rather than matching this one. + * * ## Billing and limits * * Requests are billed to your app's credit quota, which is the same shared