API Security

Authentication

Inference endpoints require a bearer API key:

Authorization: Bearer <stogas_api_key>
Content-Type: application/json

/v1/catalog and /v1/models are public. API keys are not accepted in query parameters or cookies.

Browser access

The public API allows cross-origin requests and uses bearer authentication rather than cookies:

Access-Control-Allow-Origin: *

Do not expose a privileged API key in public browser code. Use a narrowly limited key or your own server when users must not receive the credential.

Request handling

• Unknown top-level JSON fields are rejected.
• Compressed bodies are checked after decompression; oversized bodies return 413.
• Arbitrary client headers are not forwarded to providers.
• Provider response headers are hidden unless they are on the safe diagnostics allowlist.
• Client-supplied private Stogas and Bifrost control headers are rejected.

Optional diagnostics

Request safe response metadata with:

X-Stogas-Return-Extra-Fields: provider,model_requested,latency

For request transformation debugging, raw_request and raw_response may also be requested. These fields can contain prompt or model-output data and should not be logged without an appropriate data policy.