Authentication

CloudVera supports two authentication methods: session-based (for the web dashboard) and API key-based (for programmatic access).

Features

Magic Link Login

Enter your email, receive a secure link, click to sign in. No passwords to manage. Optional TOTP and WebAuthn MFA available.

Virtual API Keys

Create scoped API keys for your applications. Keys start with "cvk_" and are passed via the Authorization header. Each key enforces endpoint permissions (chat, embeddings, run), model allow-lists, budget limits, and rate limits.

Provider Keys

Your actual provider API keys (OpenAI, Anthropic, etc.) are passed via the X-Provider-Key header. CloudVera forwards them directly — keys are never stored.

JWT Sessions

The web dashboard uses short-lived JWT tokens (15 min) with automatic refresh. Sessions are fingerprinted and can be revoked from Settings.