API Keys
Exactly one active key per Project. Rotation is a hard cutover — the old secret dies immediately. Keys are shown once, stored hashed, and never retrieved again.
Security
Access is deliberate. Secrets stay short-lived.
Fabrix is built as an internal company gateway: provisioned Organisations, hashed Project keys, and a hard line between what clients see and what providers receive.
Controls in v1
Provider concealment
Client responses echo Fabric Model slugs only. Upstream provider names, base URLs, and vendor model ids stay off the wire to apps.
Model Access allow-lists
Organisations can only call Fabric Models a Platform Admin has granted. Unknown or disabled models are rejected.
Suspension
Platform Admins can freeze inference, top-ups, and key changes while leaving the dashboard read-only for usage, balance, and appeals.
Rate limits
Per-Organisation RPM limits protect the gateway and upstream providers. Excess traffic receives a clear client error.
No public signup
Organisations and Platform Admins are seeded or created by staff. There is no open registration surface on the gateway.
Operational boundaries
- Dashboard identities are email + password with transactional password reset — Platform Admin and Organisation Login are globally unique.
- Fabrix has no per-seat roles inside an Organisation; key sharing and internal misuse are the Organisation's responsibility.
- Usage and ledger history persist through Project archive and Organisation suspension for audit.
- Questions about data handling: legal@fabrix1.com · Privacy policy
Reach out anytime
Rotate a key in the dashboard
Organisation Login can rotate Project API Keys any time. The previous secret stops working immediately.