Skip to content
Davirix

Authentication

PartialThree different schemes are in use today. That is a known weakness — ADR-035 tracks unifying them.

Normal integration

Section titled “Normal integration”

To connect your application to Davirix, one thing is enough:

Authorization: Bearer <service-JWT>

The SDK sets it for you — you only supply the key:

dx = Davirix(api_key=os.environ["DAVIRIX_KEY"])

Full picture

Section titled “Full picture”
Service Header Do you need it
agent-runtime (execution) Authorization: Bearer <service-JWT> ✅ yes
platform-core X-API-Key + X-Tenant-Id usually no
knowledge-runtime · integration-hub X-Service-Key + X-Tenant-Id usually no

Tenant

Section titled “Tenant”

Every request must state which organisation it belongs to:

# Once on the client — applies to all calls
dx = Davirix(api_key=..., tenant_id="bank-uz")


# Or per call
dx.run(agent_id=..., tenant_id="bank-uz", input=...)

If neither is given the SDK raises — it does not silently pick a default. Writing to the wrong tenant is a data boundary violation.

Storing the key

Section titled “Storing the key”
✅ Right ⛔ Wrong
Environment variable Hard-coded in source
Secret manager / Vault Committed to the repo
CI secret Printed to logs or error messages

Davirix never returns your key in a response, log or error message — neither should you.

Next

Section titled “Next”