Authentication
API-key auth for inference, SIWE for key management, and x402 for payments.
The gateway uses two authentication methods depending on the endpoint:
API Key Authentication
Used for inference (/v1/chat/completions) and usage queries (/v1/usage).
Authorization: Bearer sk-<64 hex chars>The gateway hashes your key (keys are stored hashed, never in plaintext) and matches it against active, non-revoked keys. If valid, the request proceeds and is billed to the associated wallet.
How it works
SIWE Authentication
Used for API key management (/v1/auth/keys). Sign-In with Ethereum (SIWE) proves wallet ownership without sessions.
Building a SIWE Message
import { SiweMessage } from 'siwe'
const siweMsg = new SiweMessage({
domain: 'agent-router.gaib.ai',
address: walletAddress, // checksummed EIP-55
uri: 'https://agent-router.gaib.ai/v1/auth/keys',
version: '1',
chainId: 8453, // Base mainnet
nonce: crypto.randomUUID().replace(/-/g, '').slice(0, 16),
issuedAt: new Date().toISOString(),
statement: 'Sign in to the AI Gateway',
})
const message = siweMsg.prepareMessage()
const signature = await walletClient.signMessage({ account: address, message })In a browser, use window.location.host and window.location.origin for domain/uri instead of hardcoding the gateway's host. A headless agent with no browser context should use the literal values above.
Verification Rules
- SIWE signature must be valid
issuedAtmust be within the last 5 minutes- Address is lowercased for storage
Generate a fresh issuedAt timestamp before each call. The server rejects SIWE messages older than 5 minutes.
x402 Payment Authentication
Used for top-up (/v1/topup). No wallet auth needed — the payment signature itself proves the payer.