Context
Per CTO decision: example-x402#9 (redact LEMMA_API_KEY from wrangler.toml) will NOT be merged until users can self-issue their own API keys. The current demo key is intentionally exposed as an accepted risk.
Requirements
- Users can generate their own LEMMA_API_KEY via a dashboard (no manual admin provisioning)
- Dashboard should be a simple web UI or CLI tool
- Generated keys are stored as Cloudflare Workers secrets (not in code)
- After this ships, example-x402#9 can be merged + key rotated
Blocks
- example-x402#9 (security PR on hold until this is ready)
Open Questions
- Where does the dashboard live? (services/ ? separate app? workers route?)
- Key storage: D1? KV? Cloudflare secrets API?
- Auth boundary: who can issue keys?
Context
Per CTO decision:
example-x402#9(redact LEMMA_API_KEY from wrangler.toml) will NOT be merged until users can self-issue their own API keys. The current demo key is intentionally exposed as an accepted risk.Requirements
Blocks
Open Questions