How it fits together

Apikee has a small object model. Learn these five nouns and the rest of the product follows.

Workspace              acme
└── Project            payments-api
    └── Environment    production          ← addressed as payments-api-production
        ├── Endpoint   GET /v1/users
        ├── Template   "Partner tier"      (rate limits, shared by clients)
        └── Client     "Mobile app"
            └── Key    apikee_…            (tenant, scopes, expiry — signed in)

Two supporting objects hang off an environment: endpoints, which describe your routes, and templates, which carry reusable rate limits.

AddressingCopy Anchor Link

Almost every API call and URL identifies an environment with a single string:

<project-slug>-<env-type>

payments-api-production
payments-api-staging

A project slug may itself contain dashes. Resolution tries the whole string as a project slug first, then falls back to splitting off a trailing environment type, so payments-api-production resolves correctly even though the slug contains a dash.

The path of a requestCopy Anchor Link

When a call arrives at your API, this is what happens:

1. Your SDK verifies the key locally. Signature, embedded expiry, scopes — pure CPU, roughly 0.1ms, no network. A forged or expired key is rejected here and never reaches your handler or the platform.

2. In local mode, that is the end of it. Your handler runs.

3. In server mode, the SDK also reports to the platform — asynchronously, so it does not sit in your response path. That is what produces revocation checks, usage counts, IP allow-listing and rate limits. The platform runs eight checks, cheapest first, and logs every outcome.

The important property: the expensive, centralised work is additive. If the platform is unreachable and you have failOpen set, your API still serves traffic on the strength of the local signature check.

What is signed into a keyCopy Anchor Link

A key is not a random string with a database lookup behind it. It carries its own claims:

Because these are signed, they cannot be edited after issuance — which is also why scopes and environment are immutable and expiry can only be shortened. To widen access, issue a new key.