Credentials

Create once — plaintext secret shown once
Stored hashed at rest; header X-CUEVANTA-Token
Scope, expiry, revoke, rotate, last-used
Missing / invalid / revoked / over-quota → denied

CONNECT held · free product · no secrets on this site.

Self-serve credentials

POST /auth/register then verify (inline verify URL)
POST /auth/login
POST /credentials — plaintext secret returned once; stored hashed in D1
Send X-CUEVANTA-Token on brokered routes

CONNECT held. Free only. No Worker secrets in this site.