Authentication

Every request to the Gatelit gateway must include an Authorization header. The gateway reads the scheme prefix to determine how to verify the token.

Auth modes

GatelitSigned
Bearer (OIDC)
GatelitKey

Your backend signs a short-lived token (60-second TTL by default) for a specific user and returns it to your frontend. The frontend includes it in every request.Best for: Frontend or mobile apps where end users interact with LLMs directly.

Authorization: GatelitSigned <token>

The token is an HMAC-SHA256 signed JWT issued by your server using the signToken() helper from @gatelit/sdk. No database lookup is required at the gateway — the signature is verified cryptographically.Full guide →

Pass the user’s existing OIDC session token directly. The gateway verifies it against your identity provider’s JWKS endpoint.Best for: Apps where users already authenticate with Clerk, Supabase Auth, or Auth0 and you want to reuse that session.

Authorization: Bearer <oidc-token>

Supported providers: Clerk, Supabase Auth, Auth0 (any provider that exposes a /.well-known/jwks.json endpoint).Full guide →

A long-lived service key tied to your org. You create and revoke keys from the dashboard.Best for: Backend services, cron jobs, agents, or any server-side caller where there is no end user.

Authorization: GatelitKey <key>

Never use service keys in frontend code. They are long-lived credentials that grant full gateway access.

Full guide →

Comparison

	GatelitSigned	Bearer (OIDC)	GatelitKey
Lifetime	Short-lived (default 60s)	Matches OIDC token TTL	Long-lived until revoked
Issued by	Your backend	Your identity provider	Gatelit dashboard
Best for	Frontend/mobile apps	Apps with existing OIDC sessions	Backend-to-backend, agents
Requires backend?	Yes — to sign tokens	No	No (but keep server-side)
Per-user	Yes	Yes	No
Model restriction	Optional — embed in token	No	No

Authorization header format

All three schemes use the same Authorization header with a different prefix:

# GatelitSigned — short-lived token from your backend
Authorization: GatelitSigned eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

# Bearer — OIDC token from Clerk, Supabase Auth, or Auth0
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6Ii4uLiJ9...

# GatelitKey — long-lived service key from the dashboard
Authorization: GatelitKey glk_live_...

Get Started

Guides

Dashboard

Authentication

Auth modes

Comparison

Authorization header format

​Auth modes

​Comparison

​Authorization header format

Auth modes

Comparison

Authorization header format