Edge-first. Encrypted credentials. Transparent proxy. Every layer designed so humans and AI agents call any API through one hub.
SYSTEM OVERVIEW
Client, edge, storage, upstream
Every request follows the same path. Any client hits the edge for auth and routing. The edge reads metadata from D1, specs from R2, and proxies to upstream APIs.
# API ArchitecturePurpose-built for developers and AI agents to connect, proxy, and call any API.
api.liteio.dev is an edge-first API hub. Every design decision — from credential encryption to the transparent proxy pipeline to MCP integration — serves both human developers and AI agents through one unified interface.
## System Overview
### Key Points- HKDF-SHA256 derives a unique AES key per actor from a single Worker secret- AES-GCM-256 encrypts the full auth_config JSON object- Random IV per encryption — stored alongside ciphertext in D1- Decrypt only at proxy time — credentials flow from D1 → memory → upstream request → garbage collected- Masked in all responses — API responses show sk-p*.. style masking## Proxy Pipeline
Every proxied request follows this exact path:
1. Client sends request
POST /proxy/cn_a8f3e1b2/v1/chat/completions
Authorization: Bearer sk_user_api_key
2. Auth middleware
→ Validate bearer token (session or API key)
→ Extract actor identity
→ Check scope (must include "proxy" or "*")
3. Connection lookup
→ SELECT * FROM connections WHERE id = ? AND actor = ?
→ Verify connection exists and belongs to this actor
4. Credential decryption
→ Derive AES key: HKDF(SIGNING_KEY, actor)
→ Decrypt auth_config: AES-GCM-256(key, iv, ciphertext)
→ Parse JSON: {"token": "sk-proj-actual-key"}
5. Build upstream request
→ URL: connection.base_url + remaining path
→ Method: same as client request
→ Body: forwarded as-is
→ Headers: stripped (no Authorization, Cookie, Host from client)
6. Inject auth headers
→ bearer: Authorization: Bearer {token}
→ api_key: {header}: {key}
→ basic: Authorization: Basic base64({username}:{password})
→ oauth2_token: Authorization: Bearer {access_token}
→ Extra headers merged from connection config
7. Fetch upstream
→ fetch(upstream_url, {method, headers, body})
→ Capture status, headers, body, duration
8. Background logging
→ INSERT INTO request_log (actor, connection_id, method, path, status, duration_ms)
→ UPDATE connections SET request_count = request_count + 1
9. Respond to client
→ Forward upstream status code
→ Forward upstream headers (stripped: set-cookie, transfer-encoding)
→ Forward upstream body
→ Add X-Proxy-Duration-Ms header
## Security Model- No plaintext credentials — AES-GCM-256 encrypted at rest, HKDF per-actor key derivation- Actor isolation — every query includes WHERE actor = ?, no cross-tenant access- Ed25519 auth — no passwords, challenge-response with public-key cryptography- Scoped API keys — restrict to read, write, proxy, or admin; set TTL and revoke- Header stripping — client Authorization/Cookie stripped before upstream; upstream Set-Cookie stripped before client- Audit logging — every proxy call logged with actor, method, status, duration (no body stored)- Rate limiting — D1-backed sliding window, fail-open design- CORS** — configurable, defaults to allow all origins## Links- Developer Guide — Quickstart, code examples- API Reference — Full endpoint documentation- Marketplace — Browse popular APIs- MCP Tools — AI agent integration