SDK — exchangeToken()
import { exchangeToken } from "@gatelit/sdk"
const { token } = await exchangeToken({
gatewayUrl: "https://gateway.gatelit.dev",
serviceKey: process.env.GATELIT_SERVICE_KEY!,
sub: "user_123",
model: "openai/gpt-4o",
ttl: 60,
})
// → { token: "eyJ...", scheme: "GatelitSigned" }
curl https://gateway.gatelit.dev/v1/auth/token \
-H "Content-Type: application/json" \
-H "Authorization: GatelitKey glk_..." \
-d '{
"sub": "user_123",
"ttl": 60
}'
import requests
url = "https://gateway.gatelit.dev/v1/auth/token"
payload = {
"sub": "<string>",
"ttl": 60,
"model": "<string>",
"maxTokens": 123,
"endUserId": "<string>",
"requestSource": "api"
}
headers = {
"Authorization": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
sub: '<string>',
ttl: 60,
model: '<string>',
maxTokens: 123,
endUserId: '<string>',
requestSource: 'api'
})
};
fetch('https://gateway.gatelit.dev/v1/auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://gateway.gatelit.dev/v1/auth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'sub' => '<string>',
'ttl' => 60,
'model' => '<string>',
'maxTokens' => 123,
'endUserId' => '<string>',
'requestSource' => 'api'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://gateway.gatelit.dev/v1/auth/token"
payload := strings.NewReader("{\n \"sub\": \"<string>\",\n \"ttl\": 60,\n \"model\": \"<string>\",\n \"maxTokens\": 123,\n \"endUserId\": \"<string>\",\n \"requestSource\": \"api\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://gateway.gatelit.dev/v1/auth/token")
.header("Authorization", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"sub\": \"<string>\",\n \"ttl\": 60,\n \"model\": \"<string>\",\n \"maxTokens\": 123,\n \"endUserId\": \"<string>\",\n \"requestSource\": \"api\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://gateway.gatelit.dev/v1/auth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"sub\": \"<string>\",\n \"ttl\": 60,\n \"model\": \"<string>\",\n \"maxTokens\": 123,\n \"endUserId\": \"<string>\",\n \"requestSource\": \"api\"\n}"
response = http.request(request)
puts response.read_body{
"token": "eyJhbGciOiJIUzI1NiJ9...",
"scheme": "GatelitSigned"
}{
"error": true,
"code": "unauthorized",
"message": "Invalid service key"
}API Reference
Token Exchange
Exchange a long-lived service key for a short-lived signed token.
POST
/
v1
/
auth
/
token
SDK — exchangeToken()
import { exchangeToken } from "@gatelit/sdk"
const { token } = await exchangeToken({
gatewayUrl: "https://gateway.gatelit.dev",
serviceKey: process.env.GATELIT_SERVICE_KEY!,
sub: "user_123",
model: "openai/gpt-4o",
ttl: 60,
})
// → { token: "eyJ...", scheme: "GatelitSigned" }
curl https://gateway.gatelit.dev/v1/auth/token \
-H "Content-Type: application/json" \
-H "Authorization: GatelitKey glk_..." \
-d '{
"sub": "user_123",
"ttl": 60
}'
import requests
url = "https://gateway.gatelit.dev/v1/auth/token"
payload = {
"sub": "<string>",
"ttl": 60,
"model": "<string>",
"maxTokens": 123,
"endUserId": "<string>",
"requestSource": "api"
}
headers = {
"Authorization": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
sub: '<string>',
ttl: 60,
model: '<string>',
maxTokens: 123,
endUserId: '<string>',
requestSource: 'api'
})
};
fetch('https://gateway.gatelit.dev/v1/auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://gateway.gatelit.dev/v1/auth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'sub' => '<string>',
'ttl' => 60,
'model' => '<string>',
'maxTokens' => 123,
'endUserId' => '<string>',
'requestSource' => 'api'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://gateway.gatelit.dev/v1/auth/token"
payload := strings.NewReader("{\n \"sub\": \"<string>\",\n \"ttl\": 60,\n \"model\": \"<string>\",\n \"maxTokens\": 123,\n \"endUserId\": \"<string>\",\n \"requestSource\": \"api\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://gateway.gatelit.dev/v1/auth/token")
.header("Authorization", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"sub\": \"<string>\",\n \"ttl\": 60,\n \"model\": \"<string>\",\n \"maxTokens\": 123,\n \"endUserId\": \"<string>\",\n \"requestSource\": \"api\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://gateway.gatelit.dev/v1/auth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"sub\": \"<string>\",\n \"ttl\": 60,\n \"model\": \"<string>\",\n \"maxTokens\": 123,\n \"endUserId\": \"<string>\",\n \"requestSource\": \"api\"\n}"
response = http.request(request)
puts response.read_body{
"token": "eyJhbGciOiJIUzI1NiJ9...",
"scheme": "GatelitSigned"
}{
"error": true,
"code": "unauthorized",
"message": "Invalid service key"
}POST /v1/auth/token
Exchange a long-lived service key for a short-lived GatelitSigned token. The gateway verifies the service key, signs a token with its internal secret, and returns it. No raw signing secret is ever exposed to your backend.
Use this to issue per-user tokens from your backend — authenticate with a service key, provide the user’s identity and optional constraints, and receive a token your frontend can use directly with any other gateway endpoint.
Auth
Only service keys are accepted at this endpoint. Signed tokens and OIDC are rejected.Authorization: GatelitKey glk_...
Request body
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
sub | string | Yes | — | Subject identifier — typically the end user’s ID |
ttl | integer | No | 60 | Token lifetime in seconds (max 3600 / 1 hour) |
model | string | No | — | Restrict the token to one model in provider/model format |
maxTokens | integer | No | — | Cap output tokens per request for this token |
endUserId | string | No | — | End-user identifier for log filtering |
requestSource | string | No | "api" | "api" or "eval" — tags requests in logs |
orgId from the service key used to authenticate the exchange. This enables org-scoped provider key resolution for the downstream requests.
Response
{
"token": "eyJhbGciOiJIUzI1NiJ9...",
"scheme": "GatelitSigned"
}
token with the GatelitSigned scheme on all other gateway endpoints:
Authorization: GatelitSigned eyJhbGciOiJIUzI1NiJ9...
Examples
curl — minimal
curl https://gateway.gatelit.dev/v1/auth/token \
-H "Content-Type: application/json" \
-H "Authorization: GatelitKey glk_..." \
-d '{
"sub": "user_123",
"ttl": 60
}'
curl — with model constraint and token cap
curl https://gateway.gatelit.dev/v1/auth/token \
-H "Content-Type: application/json" \
-H "Authorization: GatelitKey glk_..." \
-d '{
"sub": "user_123",
"model": "openai/gpt-4o",
"maxTokens": 2000,
"ttl": 300,
"endUserId": "customer_789",
"requestSource": "api"
}'
SDK — exchangeToken()
import { exchangeToken } from "@gatelit/sdk"
const { token } = await exchangeToken({
gatewayUrl: "https://gateway.gatelit.dev",
serviceKey: process.env.GATELIT_SERVICE_KEY!,
sub: session.userId,
model: "openai/gpt-4o",
maxTokens: 2000,
ttl: 60,
})
// → { token: "eyJ...", scheme: "GatelitSigned" }
Errors
| Status | Code | Meaning |
|---|---|---|
| 400 | gateway_error | Missing required sub field or invalid JSON |
| 401 | unauthorized | Invalid service key or wrong auth scheme (not GatelitKey) |
Authorizations
Long-lived service key for backend-to-backend use.
Format: GatelitKey glk_...
Create service keys in the dashboard under Settings → Service Keys.
Body
application/json
Subject identifier — typically the end user's ID.
Token lifetime in seconds (max 1 hour).
Required range:
1 <= x <= 3600Restrict to one model in provider/model format.
Cap output tokens per request.
End-user identifier for log filtering.
Available options:
api, eval