Authentication

Secret Bearer keys are for your backend only. The hosted page never sees that key.

SKU 1 — secret key

Authorization: Bearer <secret-key>
POST https://api.askaimee.com/v1/stream

Store the key in server config. Rotate from FAC /admin/aimee/api-clients or ops/provision_api_client.php. Only a SHA-256 hash is stored; plaintext is shown once.

New partner rows default to agent aimee-partner, no admin scopes, no model override, Deep Dive off unless sales enables it.

SKU 2 — hosted page

Your users sign in at login.askaimee.com (email, password, tenant) and are redirected to https://{slug}.askaimee.com/ with a signed session that lasts 12 hours. Your tenant admin manages users, branding, and the subscription on the tenant’s /account page. No API key is involved in the browser at any point.

For integrations, your backend can instead call POST /v1/hosted-session with your Bearer key and inject the returned token into the launcher or iframe (see identity). That mint defaults to 1 hour (clamped 5 minutes–12 hours). Hosted PHP maps Host → app_slug, verifies the session, and forces the allowed agent. Browser JavaScript talks only to {slug}.askaimee.com (same origin), never to api. with a secret.

The launcher script is not an API key. The tenant URL without a session redirects to the sign-in page. The login form remembers the last tenant slug and loads that tenant’s logo from /brand/logo?tenant={slug}.

Iframe allowed origins are required to embed the page. They are clickjacking protection (frame-ancestors), not user authentication.

Subscription gate

Chat is allowed when the client subscription is trial or active. If it lapses (past_due or canceled), non-admins cannot sign in. Admins can still reach /account. Disabling a user blocks chat immediately.