Issue, list, rotate and revoke API keys with explicit scopes and a fixed-window quota. The dashboard shows your keys, request log, webhook deliveries, dead letters and receipt-backed test payments, so you can read a refusal back to the key that caused it. Webhooks sign each delivery with Ed25519, repeat the same delivery id over byte-identical bodies, and report nothing as delivered until your endpoint accepts it. These services run behind a limited beta gate rather than open public endpoints.

What it does

The Paxeer X gateway issues principal-bound API keys with explicit scopes and a fixed-window request quota, and refuses any call outside them. A read-only dashboard service projects one developer's keys, quota windows, request log, webhook health and receipt-backed test payments. A webhook service delivers journey, payment, approval and program events to the developer's own HTTPS endpoint, signed with Ed25519 and retried until accepted or dead-lettered. An indexer follows both domains and serves asset and account-history reads.

Key capabilities

• Issue, list, rotate and revoke API keys over /v1/keys against an authenticated session.
• Six scopes and a per-key request quota; an out-of-scope route is refused, not downgraded.
• Dashboard reads keys, usage, request log, webhook deliveries, dead letters and receipts.
• Signed, ordered, at-least-once webhook delivery with dead letters, redelivery and replay.
• Indexer serves asset reads and per-account history, with a backfill mode to a cutover height.
• Key issuance and every webhook mutation take an Idempotency-Key, so a retry replays.

Differentiators

Delivery is durable before transmission: publish compare-and-sets the event and its pending delivery rows into the principal's Redis shard before any HTTP POST is attempted. Every attempt and redelivery of one event repeats the same layerx-webhook-id over a byte-identical body, so a receiver deduplicates an at-least-once repeat instead of treating it as a conflict. Keys are derived by HMAC over the issuance idempotency scope, so a retried issuance returns the same credential rather than a second key. The dashboard carries a verification level per fact rather than one overall status: unverified, receipt-verified, checkpoint-finalised or paxeer-finalised.

Outcomes

• Refuse out-of-scope routes outright instead of quietly downgrading them.
• Retry a key issuance and get the same credential, not a second key.
• Read a verification level per fact rather than one overall status.

Technical notes

• Keys: secrets are lxp_live_ plus 64 hex characters, presented as Authorization: LayerX-Key <key-id>:<secret>; only a salted digest is stored. Issuance requires an Idempotency-Key and a signer public key the session owns, or it is refused with signer_not_owned.
• Scopes are activity:write, program:call, program:read, program:simulate, receipt:read, state:read, at most six and strictly ascending. A route the key does not cover is 403 insufficient_scope.
• Quotas are fixed windows of 1 to 1,000,000 requests over 1 to 2,592,000 seconds. Exceeding one is 429 quota_exceeded with Retry-After. Caller-supplied x-layerx-principal or x-layerx-api-key headers are refused with 400 untrusted_identity_header.
• Gateway transport limits: 8 MiB request body, 256 concurrent connections, 128 requests per connection.
• Dashboard: GET /v1/dashboard/{overview,keys,usage,requests,webhooks,webhook-deliveries,webhook-dead-letters,test-payments,receipts/<activity>}, authenticated by bearer token or the __Host-layerx-session cookie; limit defaults to 50 and is clamped to 1-200, and the overview page is 20. The web app is Next.js 16.3.5 and React 19.2.8 with five tabs, and its engines field pins Node.js 24 or newer.
• Webhooks: scheme LayerX/webhooks/v1, Ed25519 over "<id>.<timestamp>." followed by the exact body bytes, 300-second default tolerance and 30-second future skew. Retry defaults are eight attempts, 10-second base, 3,600-second cap, 20 per cent spread, 120-second in-flight lease, and suspension after 20 consecutive dead letters. Destinations must be https:// with a canonical DNS name resolving only to public addresses, at most 32 per principal. The receiver obligation is published at GET /v1/webhooks/scheme.
• Payment events carry amount and asset at unverified, and an event's header level is its weakest fact, so an endpoint whose minimum_verification is above unverified does not receive payment events. FailureKind::Suspended and EndpointSuspended exist on the wire but no code path constructs either; a suspended endpoint is skipped instead.
• Indexer: layerx-indexer runs one follow loop per configured domain and serves /healthz, /v1/assets, /v1/assets/<asset> and /v1/history/<account> with cursor, limit and kind parameters. A backfill mode copies from a Paxscan database up to a cutover height. A reorg beyond finality or an integrity failure exits 2 rather than continuing.
• Not yet delivered: these are Kubernetes-shaped services on the same limited-beta gate as the gateway, not open public endpoints. The developer ingress host is the example name developers.layerx.example, no single-container developer path is declared, the dashboard is deployed from the webhook manifest rather than its own, and the indexer has neither a Dockerfile nor a deployment manifest. Monitoring is a local compose file only: Grafana runs on default admin/admin, there are no alerting rules, and Prometheus scrapes four local chain nodes rather than the /metrics endpoints the gateway and registry expose.
• The program registry that sits beside these services needs a 1 GiB ReadWriteOnce volume for its journal and a one-shot systemd unit ordered before kubelet, which caps concurrent builds at four under a 5 GiB build quota.
• A LayerX activity costs 1/10 of a cent. Runtime floors: Node.js 22 or newer, Python 3.11 or newer.

// npm install layerx-sdk
import { AgentHttpTransport, LayerXKeyCredential, SecretBytes } from "layerx-sdk";

const credential = new LayerXKeyCredential(
  process.env.LAYERX_KEY_ID!,
  new SecretBytes(Buffer.from(process.env.LAYERX_KEY_SECRET!, "utf8")),
);
const transport = new AgentHttpTransport({
  endpoint: process.env.LAYERX_GATEWAY_URL!,
  credential,
  timeoutMs: 30_000,
});

More in Interface