Policy

Public-safe read-only access stays open. Mutations, persistence, publishing, bulk imports, private exports, and destructive actions require PLATPHORM_API_KEY.

Trust Boundary

Web dashboard, public-safe discovery, browser-based operations, trusted-domain discovery, standard route compliance, Vercel metadata capture, trace inspection, and agentic workflow discovery are intentionally supported for public read-only debugging and operator workflows. Mutating, administrative, ingestion, replay, fork, remediation, deployment, sync, test-triggering, reporting, and write actions require PLATPHORM_API_KEY.

{
  "platformKey": "PLATPHORM_API_KEY",
  "acceptedHeaders": [
    "Authorization: Bearer $PLATPHORM_API_KEY",
    "X-PlatPhorm-API-Key: $PLATPHORM_API_KEY"
  ]
}