zuplo 7.2.3 → 7.2.4

package/docs/policies/query-param-to-header-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "query-param-to-header-inbound",
   "products": ["api-gateway"],
   "description": "Extracts a query parameter and sets it as a header in the request.",
   "deprecatedMessage": "",

package/docs/policies/quota-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "quota-inbound",
   "products": ["api-gateway"],
   "description": "The Quota policy enables you to set monthly, weekly, daily or hourly quotas on your API.",
   "deprecatedMessage": "",

package/docs/policies/rate-limit-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "rate-limit-inbound",
   "products": ["api-gateway"],
   "description": "Rate limiting policy to control the number of requests to your API. Supports multiple identification strategies (by user, IP, header, etc.) and can operate in strict or async mode for different performance characteristics.",
   "deprecatedMessage": "",

package/docs/policies/readme-metrics-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "readme-metrics-inbound",
   "products": ["api-gateway"],
   "description": "Readme is a developer documentation and API metrics company. This policy pushes logs to their API calls dashboard.",
   "deprecatedMessage": "",

package/docs/policies/remove-headers-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "remove-headers-inbound",
   "products": ["api-gateway"],
   "description": "Remove headers from the incoming request.",
   "deprecatedMessage": "",

package/docs/policies/remove-headers-outbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "remove-headers-outbound",
   "products": ["api-gateway"],
   "description": "Remove configured headers from the outgoing response.",
   "deprecatedMessage": "",

package/docs/policies/remove-query-params-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "remove-query-params-inbound",
   "products": ["api-gateway"],
   "description": "Remove query parameters from the incoming request",
   "deprecatedMessage": "",

package/docs/policies/replace-string-outbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "replace-string-outbound",
   "products": ["api-gateway"],
   "description": "Replace a string in the incoming request body",
   "deprecatedMessage": "",

package/docs/policies/request-size-limit-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "request-size-limit-inbound",
   "products": ["api-gateway"],
   "description": "Enforces a maximum size in bytes of the incoming request.",
   "deprecatedMessage": "",

package/docs/policies/request-validation-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "request-validation-inbound",
   "products": ["api-gateway"],
   "description": "Validates incoming requests against your OpenAPI specification. Checks query parameters, path parameters, headers, and request body to ensure they match the defined schema before processing.",
   "deprecatedMessage": "",

package/docs/policies/require-origin-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "require-origin-inbound",
   "products": ["api-gateway"],
   "description": "Sets an allow-list for an origin header",
   "deprecatedMessage": "",

package/docs/policies/require-user-claims-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "require-user-claims-inbound",
   "products": ["api-gateway"],
   "description": "Authorizes requests by validating claims on the authenticated user (`request.user`) against a configurable rule of `and`/`or` combinators and per-claim `eq`, `in`, and `startsWith` checks. Run it after any authentication policy that populates `request.user` — a JWT auth policy, API key auth, mTLS, and so on — to allow only specific callers (service accounts, OAuth clients, tenants, groups) without writing custom code.\n\nEvery check fails closed: a missing or non-primitive claim never matches, comparisons are strict and type-sensitive, and requests without an authenticated user receive a 401 response. Denied requests receive a 403 response that does not echo claim values or expected values; the failing checks are written to the request log instead.\n\nValidation of the options runs lazily inside the policy constructor, which the runtime caches per policy name. Misconfigured options therefore fail on first use with a customer-facing `ConfigurationError` instead of failing at module load.",
   "deprecatedMessage": "",

package/docs/policies/secret-masking-outbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "secret-masking-outbound",
   "products": ["api-gateway"],
   "description": "Masks common secrets like Zuplo API keys, GitHub tokens, or SSH private key in the response body.",
   "deprecatedMessage": "Use the [Data Loss Prevention](https://zuplo.com/docs/policies/data-loss-prevention-outbound) policy instead. It detects the same Zuplo API keys, GitHub tokens, and private key blocks via its `secret-zuplo`, `secret-github`, and `secret-private-key` recognizers, plus 60+ more built-in entities, and can block or log a response rather than only masking it. This policy will continue to work but will be removed in a future version of Zuplo.",

package/docs/policies/semantic-cache-inbound/schema.json

@@ -3,16 +3,17 @@
   "$id": "https://cdn.zuplo.com/policies/runtime/schemas/semantic-cache-inbound.json",
   "type": "object",
   "title": "Semantic Cache",
-  "isDeprecated": false,
+  "isDeprecated": true,
   "isPaidAddOn": false,
   "isEnterprise": true,
   "isInternal": false,
   "isBeta": false,
   "isHidden": false,
   "requiresAI": true,
+  "policyType": "semantic-cache",
   "products": ["ai-gateway"],
   "description": "Respond to matched incoming requests with semantically cached content\n\nThe Semantic Cache Inbound policy caches responses based on semantic similarity of cache keys rather than exact matches. This allows for more flexible caching where similar requests can return cached responses even if the cache key is not exactly the same.\n\nThe policy uses Large Language Model (LLM) embeddings to determine semantic similarity between cache keys based on a configurable similarity tolerance.\n\nOptions: - semanticTolerance: The semantic similarity threshold for semantic cache matches (0-1, default: 0.2). Values closer to 0 require higher similarity. Can be overridden by custom functions. - expirationSecondsTtl: The timeout of the cache in seconds (default: 3600, 1 hour). Can be overridden by custom functions. - namespace: Optional namespace to isolate cache entries (default: \"default\"). Useful for multi-tenant scenarios or different cache contexts. - cacheBy: Determines how cache keys are generated: 'function' for custom logic or 'propertyPath' to extract from JSON body.",
-  "deprecatedMessage": "",
+  "deprecatedMessage": "Use [AI Gateway Semantic Cache](https://zuplo.com/docs/policies/ai-gateway-semantic-cache-v2-inbound) instead.",
   "required": ["handler"],
   "properties": {
     "handler": {

package/docs/policies/set-body-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "set-body-inbound",
   "products": ["api-gateway"],
   "description": "Sets the body of the request in the inbound pipeline - make sure to convert a GET/HEAD request to another method when using this policy.",
   "deprecatedMessage": "",

package/docs/policies/set-headers-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "set-headers-inbound",
   "products": ["api-gateway"],
   "description": "Adds or sets headers on the incoming request.",
   "deprecatedMessage": "",

package/docs/policies/set-headers-outbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "set-headers-outbound",
   "products": ["api-gateway"],
   "description": "Adds or sets headers on the on the outgoing response.",
   "deprecatedMessage": "",

package/docs/policies/set-query-params-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "set-query-params-inbound",
   "products": ["api-gateway"],
   "description": "Adds or sets query parameters on the incoming request.",
   "deprecatedMessage": "",

package/docs/policies/set-status-outbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "set-status-outbound",
   "products": ["api-gateway"],
   "description": "Sets the status code on the on the outgoing response.",
   "deprecatedMessage": "",

package/docs/policies/set-upstream-api-key-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "set-upstream-api-key-inbound",
   "products": ["api-gateway"],
   "description": "Sets a single header on the incoming request, typically used to attach an API key for the upstream service. A more directed version of the `SetHeadersInboundPolicy` that defaults the header name to `Authorization` and is intended to be used with an `$env()` reference for the value.",
   "deprecatedMessage": "",

package/docs/policies/sleep-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "sleep-inbound",
   "products": ["api-gateway"],
   "description": "Add a delay to the incoming request. Useful for testing.",
   "deprecatedMessage": "",

package/docs/policies/stripe-webhook-verification-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "stripe-webhook-verification-inbound",
   "products": ["api-gateway"],
   "description": "The Stripe Webhook policy validates the authenticity of an incoming Stripe webhook.",
   "deprecatedMessage": "",

package/docs/policies/supabase-jwt-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "supabase-jwt-auth-inbound",
   "products": ["api-gateway"],
   "description": "The Supabase JWT Authentication policy supports user JWT tokens created by Supabase.",
   "deprecatedMessage": "",

package/docs/policies/traffic-splitting-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "traffic-splitting-inbound",
   "products": ["api-gateway"],
   "description": "Splits traffic randomly across a set of weighted base paths. On each request one base path is selected (weighted by `weight`) and written to the request custom context at `customOutputProperty`. Reference it from a later URL Rewrite `rewritePattern` or URL Forward `baseUrl`, e.g. `${context.custom.trafficSplitting.basePath}`.",
   "deprecatedMessage": "",

package/docs/policies/upstream-aws-federated-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": true,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-aws-federated-auth-inbound",
   "products": ["api-gateway"],
   "description": "Resolves AWS credentials with STS AssumeRoleWithWebIdentity using Zuplo's ambient OIDC identity — no AWS keys are stored anywhere. The role's trust policy must trust the Zuplo OIDC identity provider. Resolved credentials are registered on the request context for the AWS Lambda handler and custom code to sign upstream requests with `AwsClient.fromContext`. This policy does not itself sign or forward the request.",
   "deprecatedMessage": "",

package/docs/policies/upstream-aws-service-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": true,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-aws-service-auth-inbound",
   "products": ["api-gateway"],
   "description": "Resolves AWS credentials from static access keys (optionally exchanged for an IAM role's temporary credentials via STS AssumeRole) and registers them on the request context. The AWS Lambda handler and custom code read them with `AwsClient.fromContext` to sign upstream requests. This policy does not itself sign or forward the request.",
   "deprecatedMessage": "",

package/docs/policies/upstream-azure-ad-service-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-azure-ad-service-auth-inbound",
   "products": ["api-gateway"],
   "description": "Uses Azure Active Directory to add an Authorization header to the request in order to authenticate requests using Azure identity.",
   "deprecatedMessage": "",

package/docs/policies/upstream-firebase-admin-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-firebase-admin-auth-inbound",
   "products": ["api-gateway"],
   "description": "Creates a Firebase Admin token and attaches it to the outgoing request. Useful when calling Firebase services as an administrator.",
   "deprecatedMessage": "",

package/docs/policies/upstream-firebase-user-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-firebase-user-auth-inbound",
   "products": ["api-gateway"],
   "description": "Creates a Firebase custom user token and attaches it to the outgoing request. Useful when calling Firebase services as user.",
   "deprecatedMessage": "",

package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-gcp-federated-auth-inbound",
   "products": ["api-gateway"],
   "description": "Authenticates with GCP resources or Google services using Workload Identity Federation allowing secure access to these resources without requiring the use of a service account private key.",
   "deprecatedMessage": "",

package/docs/policies/upstream-gcp-jwt-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-gcp-jwt-inbound",
   "products": ["api-gateway"],
   "description": "Creates a self-signed JWT token (generated using a Google Service Account JSON) and attaches it to the outgoing request. Useful when calling GCP services like Cloud Endpoints / ESPv2",
   "deprecatedMessage": "",

package/docs/policies/upstream-gcp-service-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-gcp-service-auth-inbound",
   "products": ["api-gateway"],
   "description": "Creates an ID Token from Google's OAuth service and attaches it to the outgoing request. Useful when calling GCP services or Google APIs that are secured with GCP IAM.",
   "deprecatedMessage": "",

package/docs/policies/upstream-oauth-client-credentials-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-oauth-client-credentials-inbound",
   "products": ["api-gateway"],
   "description": "Fetches an access token from any OAuth 2.0 token endpoint using the client credentials grant and adds it to a header (`Authorization` by default) on the upstream request. Tokens are cached until shortly before they expire.",
   "deprecatedMessage": "",

package/docs/policies/upstream-zuplo-jwt-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "upstream-zuplo-jwt-auth-inbound",
   "products": ["api-gateway"],
   "description": "Generates a Zuplo JWT token and attaches it to the outgoing request. This policy creates a self-signed JWT using the Zuplo JWT plugin and adds it to the specified header for upstream authentication.",
   "deprecatedMessage": "",

package/docs/policies/validate-json-schema-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "validate-json-schema-inbound",
   "products": ["api-gateway"],
   "description": "Validates the body of an incoming request based on a JSON schema.",
   "deprecatedMessage": "Use the new [Request Validation Policy](https://zuplo.com/docs/policies/request-validation-inbound). The new policy validates JSON bodies like this policy, but also supports validation of parameters, query strings, etc.",

package/docs/policies/web-bot-auth-inbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "web-bot-auth-inbound",
   "products": ["api-gateway"],
   "description": "Authenticate bots using web-bot-auth HTTP Message Signatures.",
   "deprecatedMessage": "",

package/docs/policies/xml-to-json-outbound/schema.json

@@ -10,6 +10,7 @@
   "isBeta": false,
   "isHidden": false,
   "requiresAI": false,
+  "policyType": "xml-to-json-outbound",
   "products": ["api-gateway"],
   "description": "Parses XML and converts it to JSON.",
   "deprecatedMessage": "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "7.2.3",
+  "version": "7.2.4",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "7.2.3",
-    "@zuplo/core": "7.2.3",
-    "@zuplo/runtime": "7.2.3",
-    "@zuplo/test": "7.2.3"
+    "@zuplo/cli": "7.2.4",
+    "@zuplo/core": "7.2.4",
+    "@zuplo/runtime": "7.2.4",
+    "@zuplo/test": "7.2.4"
   }
 }

package/docs/ai-gateway/policies/akamai-ai-firewall.mdx

@@ -1,122 +0,0 @@
----
-title: Akamai AI Firewall
-sidebar_label: Akamai AI Firewall
-description:
-  Scan prompts and completions with Akamai Firewall for AI and block what your
-  Akamai configuration denies.
----
-
-`akamai-ai-firewall-v2-inbound`
-
-The Akamai AI Firewall policy sends an app's prompts and completions to
-[Akamai Firewall for AI](https://www.akamai.com/products/firewall-for-ai) and
-blocks a request or response that your Akamai configuration denies. It's the
-gateway's guardrail policy: it can answer a request itself instead of letting it
-reach the provider.
-
-One entry covers both directions. The policy scans the prompt before the
-provider call and the completion afterward, including streaming
-responses—there's no separate outbound policy to add.
-
-Detection rules and their categories live in Akamai Control Center, not in
-Zuplo. The policy forwards text and enforces the decision that comes back,
-acting only on rules that deny. Rules set to alert are ignored.
-
-## Adding the policy to an app
-
-<Stepper>
-
-1. In your gateway's repository, set the policy's credentials and push:
-
-   ```json title="config/policies.json"
-   {
-     "name": "akamai-ai-firewall-v2-inbound",
-     "policyType": "akamai-ai-firewall-v2-inbound",
-     "handler": {
-       "export": "AkamaiAIFirewallV2InboundPolicy",
-       "module": "$import(@zuplo/runtime)",
-       "options": {
-         "configurationId": "your-configuration-id",
-         "api-key": "your-akamai-api-key"
-       }
-     }
-   }
-   ```
-
-2. Open the app's **Policies** tab, click **Add Policy**, and add **Akamai AI
-   Firewall**. Leave the entry's options alone so it inherits the declaration's
-   configuration.
-
-</Stepper>
-
-To protect every new app in a team, add the policy to the team's
-[policy template](../policy-templates.mdx).
-
-## Options
-
-| Option                                  | Default    | What it does                                                                                                            |
-| --------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------- |
-| `configurationId`                       | —          | Required. Your Akamai configuration                                                                                     |
-| `api-key`                               | —          | Required. Note the hyphen—`apiKey` is rejected                                                                          |
-| `applicationId`                         | —          | Optional Akamai application identifier                                                                                  |
-| `endpoints`                             | All shapes | Which API shapes to inspect                                                                                             |
-| `onUnknownShape`                        | `deny`     | What to do with a request shape the policy can't read                                                                   |
-| `onError`                               | `block`    | What to do when the Akamai detect call itself fails—`block` answers `502`; `allow` lets the request through uninspected |
-| `streamingAccumulation.enabled`         | `true`     | Scan streaming completions. `false` stops scanning responses for streaming requests                                     |
-| `streamingAccumulation.eventsInterval`  | `5`        | How many streamed events to buffer between checks                                                                       |
-| `streamingAccumulation.checkIntervalMs` | none       | Also check on a timer. Off unless set                                                                                   |
-
-Unknown option keys are rejected.
-
-## What a blocked caller sees
-
-A block returns `400` in the provider's own error format—not problem
-details—with the Akamai rule ID in `code`:
-
-```json
-{
-  "error": {
-    "message": "Request blocked by AI Firewall during completion request. <rule message> (Rule: <ruleId>)",
-    "code": "<ruleId>"
-  }
-}
-```
-
-For a streaming response, the gateway withholds output until each check passes,
-so blocked content never reaches the client. The stream then ends with a
-content-filter stop rather than an HTTP error, so clients see a content-filter
-finish reason. Holding events until a check returns adds to time to first token.
-
-Blocked requests are counted against the app and appear in its Dashboard—see
-[Monitoring usage](../usage-limits.mdx#monitoring-usage).
-
-## Failure modes
-
-| Situation                                                      | Result                                           |
-| -------------------------------------------------------------- | ------------------------------------------------ |
-| Options are invalid or incomplete                              | Fails closed—request rejected                    |
-| The request body can't be read                                 | Fails closed—request rejected                    |
-| An endpoint shape the policy can't inspect, such as embeddings | `400`, code `guardrail_uninspectable`            |
-| Akamai is unreachable, or returns an error                     | Fails closed—`502`, code `guardrail_unavailable` |
-
-:::caution
-
-With `onError: "allow"` the policy fails open instead: an expired Akamai key
-silently disables the firewall while the gateway keeps returning `200`s. Monitor
-blocked counts so a sudden drop to zero doesn't go unnoticed.
-
-:::
-
-An endpoint the policy can't inspect is denied by default. That's different from
-an endpoint you exclude with `endpoints`, which passes through silently. A
-provider error response is never scanned.
-
-If a request is rejected with a configuration error, the usual cause is a chain
-entry that overrode `options` and dropped the credential—entry options replace
-the declared ones wholesale rather than merging. Omit them to inherit. See
-[Options and secrets](../policy-chains.mdx#options-and-secrets).
-
-## Additional resources
-
-- [Akamai Firewall for AI](https://www.akamai.com/products/firewall-for-ai)
-- [Akamai AI security solutions](https://www.akamai.com/solutions/security/ai-security)

package/docs/ai-gateway/policies/authentication.mdx

@@ -1,43 +0,0 @@
----
-title: API key authentication
-sidebar_label: API key authentication
-description:
-  Require an app's API key on every request and resolve the calling app from it.
----
-
-`ai-gateway-auth-v2`
-
-Clients send the app's API key as a bearer token, and the gateway resolves the
-calling app from the key. A missing or invalid key returns `401`. A valid key
-whose app doesn't match the `{app_id}` in the URL returns `403`.
-
-The policy applies per app: in an app's chain, it requires a key for that app
-alone. A new top-level team's [policy template](../policy-templates.mdx)
-includes it as a locked entry—and sub-teams inherit that template by default—so
-apps created in the team require keys from the start.
-
-## Options
-
-| Option            | Default         | What it does                                                      |
-| ----------------- | --------------- | ----------------------------------------------------------------- |
-| `cacheTtlSeconds` | `10`            | How long the gateway caches a key check. `10` is also the minimum |
-| `authHeader`      | `Authorization` | The header to read the key from                                   |
-| `authScheme`      | `Bearer`        | The scheme prefix. Set it to `""` to use the raw header value     |
-
-For clients that send `x-api-key` instead of a bearer token, use
-`{ "authHeader": "x-api-key", "authScheme": "" }`.
-
-Because key checks are cached, a revoked key can keep working until the cache
-expires.
-
-:::caution{title="A gateway without this policy is open"}
-
-When an app's chain doesn't include the policy, the gateway resolves the app
-from the `{app_id}` segment of the URL and serves the request with no key at
-all. Anyone who knows the URL can spend against the app's providers and budget.
-Only run an open gateway when something else, such as network isolation,
-controls who can reach it.
-
-:::
-
-Each app's key appears on its **API Key** tab—see [Apps](../apps.mdx).