Authentication
The controlled developer preview uses scoped Gnaww API credentials.
Authenticated requests send:
X-Gnaww-API-Key: <developer-api-key>
Where a credential operates in a specific workspace, clients can also send the supported workspace context used by the official SDKs:
X-Gnaww-Workspace-Id: <workspace-id>
The long-term developer identity, API-client and entitlement authority belongs to the Gnaww Platform. Self-service credential activation is not yet the general public onboarding path. Do not assume that creating an account or SDK installation alone creates a production credential.
Current developer scopes
The reviewed v0.1 contract uses these relevant scopes:
transform:write
match:write
recipes:read
recipes:write
producer-capabilities:read
Resolved-Recipe SpecMatch requires both recipes:read and match:write.
POST /v1/interpret remains available with transform:write. If the interpreted request needs capability-grounded Production Solution Candidate evaluation, Gnaww runs that candidate-level SpecMatch only when the same credential also has match:write and its active plan gate authorises matching usage. Without both authorities, the requirement remains reviewable and no capability fit is inferred.
Private lifecycle permissions and integration-administration scopes are outside the general developer contract.
Credential handling
Treat Gnaww API credentials as secrets:
- keep them in environment variables or an appropriate secret manager;
- never place them in browser JavaScript;
- never commit them to a repository;
- never paste them into support tickets, chat or documentation;
- rotate or revoke a credential if it may have been exposed.