@devfoundry-dev/api

Internal package powering DevFoundry API — accounts, API keys, usage logging, quotas, rate limits, and hosted HTTP execution orchestration.

DevFoundry API uses the same DevFoundry Registry as DevFoundry CLI, DevFoundry MCP, and the DevFoundry Website.

Scope

• Account create / list (no teams/orgs yet)
• API key create / list / revoke (SHA-256 hashed, account-scoped)
• Bearer token authentication (df_live_…)
• Durable usage logging on every DevFoundry API invocation
• Per-key rate limiting (fixed window) + daily account quota
• File-backed store for local dev (.devfoundry/api/)
• PostgreSQL store for production (DEVFOUNDRY_API_DATABASE_URL)

Not included yet: billing, user login, teams, marketplace, workflows.

Usage

import {
  MemoryApiRepository,
  createAccount,
  createApiKey,
  executeApiInvocation,
  resolveApiRepository,
} from "@devfoundry-dev/api";

const repo = new MemoryApiRepository();
await repo.ensureDefaultAccount();

const prodRepo = await resolveApiRepository();

const account = await createAccount(prodRepo, "My project");
const { secret } = await createApiKey(prodRepo, account.id, "My integration");

const result = await executeApiInvocation({
  store: prodRepo,
  authorizationHeader: `Bearer ${secret}`,
  correlationId: "req-1",
  bytesIn: 64,
  tool: "json",
  action: "format",
  input: { content: '{"a":1}' },
  executor: myRegisteredToolExecutor,
});

Environment

| Variable | Purpose | | --- | --- | | DEVFOUNDRY_API_DATABASE_URL | PostgreSQL connection string (production) | | DEVFOUNDRY_API_STORE | file, memory, or postgres | | DEVFOUNDRY_API_DATA_DIR | Writable directory for file store | | DEVFOUNDRY_API_ADMIN_TOKEN | Protects DevFoundry API admin routes | | DEVFOUNDRY_API_RATE_LIMIT_MAX | Per-key max requests per window | | DEVFOUNDRY_API_RATE_LIMIT_WINDOW_MS | Rate-limit window (ms) |

Legacy DEVFOUNDRY_CLOUD_* variables are still read as fallbacks during migration.

Public docs: docs/devfoundry-api.md