Authentication

Relay has two caller audiences. The Relay CLI and other ingest clients authenticate with an organization secret (sk_live_* or sk_test_*). The Architect dashboard (relay/web) uses Amazon Cognito JWTs from a signed-in session.

CLI ingest (org secret)

Send X-Relay-Secret: sk_live_… or Authorization: Bearer sk_live_…. When both are present, X-Relay-Secret wins.

Create secrets in Architect under Organization → Secrets. The plaintext value is shown once at creation.

Ingest routes are rate-limited per secret (120 requests per 60-second window). Exceeding the limit returns 429.

Architect (Cognito JWT)

Dashboard routes require Authorization: Bearer <Cognito access token>. The token must include custom:tenant_id (organization id) except for POST /v1/organizations, which only needs sub and an email claim.

Member+ can read; admin+ can mutate organization settings, secrets, environments, agents, and members.