Authentication
Authorization: Bearer zea-<secret>
The gateway strips Bearer , hashes the token with SHA-256, and looks it up. Only the digest is stored — rotating ZEALLM_ENCRYPTION_KEY never invalidates virtual keys.
Health endpoints do not require auth.
Failures
| Code | HTTP | When |
|---|---|---|
missing_api_key | 401 | No header, or empty token |
invalid_api_key | 401 | Hash not found |
key_revoked | 401 | Status REVOKED |
key_expired | 401 | Status EXPIRED or ExpiresAt in the past |
key_inactive | 401 | Any other non-active status |
key_blocked | 403 | Status BLOCKED |
internal_error | 500 | Key lookup failed |
type is authentication_error for 401 and permission_error for 403.
There is no master API key on the gateway. Admin actions happen in the portal behind Entra ID and RBAC.