# API Security (/docs/reference/security)



## Authentication [#authentication]

Inference endpoints require a bearer API key:

```http
Authorization: Bearer <stogas_api_key>
Content-Type: application/json
```

`/v1/catalog` and `/v1/models` are public. API keys are not accepted in query parameters or cookies.

## Browser access [#browser-access]

The public API allows cross-origin requests and uses bearer authentication rather than cookies:

```http
Access-Control-Allow-Origin: *
```

Do not expose a privileged API key in public browser code. Use a narrowly limited key or your own server when users must not receive the credential.

## Request handling [#request-handling]

* Unknown top-level JSON fields are rejected.
* Compressed bodies are checked after decompression; oversized bodies return `413`.
* Arbitrary client headers are not forwarded to providers.
* Provider response headers are hidden unless they are on the safe diagnostics allowlist.
* Client-supplied private Stogas and Bifrost control headers are rejected.

## Optional diagnostics [#optional-diagnostics]

Request safe response metadata with:

```http
X-Stogas-Return-Extra-Fields: provider,model_requested,latency
```

For request transformation debugging, `raw_request` and `raw_response` may also be requested. These fields can contain prompt or model-output data and should not be logged without an appropriate data policy.