Every authenticated endpoint requires the x-routeplane-api-key header carrying a rp_-prefixed virtual key. That one key resolves to your tenant, your stored provider credentials, your entitlements, and your limits, so provider keys never leave the gateway's vault and never appear in your application code.
| Header | Required | Description |
|---|---|---|
x-routeplane-api-key | Yes | Your virtual key (rp_...). Maps to tenant, provider creds, entitlements, and limits. |
content-type | Yes | application/json for all POST bodies. |
A missing or invalid key returns 401. The only unauthenticated endpoint is GET /healthz.