Section 04
Governance, security, and rollout
Configuration
| Variable | Default | Purpose |
|---|---|---|
| API_KEYS_ENABLED | true (in .env.example) | Master switch for API key authentication |
UAT deployment checklist
The deploy notes define a short, concrete verification path for this release before it can be shown to clients or promoted further.
| Check |
|---|
| Migration applies cleanly on UAT |
| Admin Space, API Keys: create, list, revoke |
| API key auth succeeds on a tagged public endpoint within the key's role |
| Revoked, expired, or unknown key returns 401 |
| JWT session auth still works for the SPA |
| /docs and public OpenAPI export look correct |
| Execution polling and path responses behave as before in the UI |
| Agent chat action UI still renders outputs correctly |