config.example.yaml

host: ""
port: 8317

# Directory to store OAuth tokens
auth-dir: "~/.auth2api"

# API keys for client authentication (clients use these to access this proxy).
# Two interchangeable forms — mix freely:
#   1. Bare string: a plain key with no policy (enabled, non-admin, no quota).
#   2. Object: a key with identity (label/owner), an admin flag, a monthly
#      quota, and a per-key rate limit. Any field is optional.
# Quota and rate-limit apply to the inference endpoints only (chat/completions,
# responses, messages, count_tokens); /v1/models stays unmetered.
api-keys:
  - "your-api-key-here"            # simple key, no limits
  # - key: "sk-alice"
  #   label: "alice / dev"
  #   owner: "alice@example.com"
  #   admin: true                  # admin keys see ALL keys in /admin/usage/keys
  #   quota:
  #     monthly-tokens: 50000000   # reject after 50M tokens this UTC month
  #     monthly-cost-usd: 200      # and/or after $200 accrued cost
  #   rate-limit:
  #     rpm: 120                   # max requests per minute for this key
  #     concurrency: 8             # max concurrent in-flight requests

# Maximum JSON request body size
body-limit: "200mb"

# Upstream request timeouts
timeouts:
  messages-ms: 120000         # non-stream /v1/messages timeout
  stream-messages-ms: 600000  # stream /v1/messages timeout, suitable for Claude Code long tasks
  count-tokens-ms: 30000      # /v1/messages/count_tokens timeout

# Per-request call statistics. Aggregated by:
#   - client (sha256(api-key))
#   - upstream account (provider + email)
#   - api endpoint x model x provider
# Events are appended to <auth-dir>/stats.jsonl and replayed on startup.
# Query the live snapshot via GET /admin/stats (requires API key); each bucket
# includes totalCostUsd computed from the pricing table below.
stats:
  enabled: true

# Where usage events and UI-managed API keys are persisted.
#   sqlite (default) — a single DB file (<auth-dir>/auth2api.db) via
#     better-sqlite3; durable, queryable, survives restarts without a replay
#     of a growing text log.
#   file — legacy <auth-dir>/stats.jsonl + managed-keys.json.
# OAuth tokens are always plain files regardless of this setting.
storage:
  backend: sqlite
  # sqlite-path: "~/.auth2api/auth2api.db"   # defaults to <auth-dir>/auth2api.db

# Per-model prices for cost accounting (USD per 1,000,000 tokens). Optional —
# omit to use built-in defaults. Anthropic defaults track published rates;
# codex (gpt-*) defaults are ESTIMATES, so override them here for accurate
# cost reports. Overrides are matched by resolved model id and applied
# retroactively (stats.jsonl is re-priced on the next replay).
# pricing:
#   gpt-5.5:
#     inputPerMTok: 1.25
#     outputPerMTok: 10
#     cacheWritePerMTok: 0
#     cacheReadPerMTok: 0.125

# Debug logging level:
# off = no extra logs
# errors = upstream/network failure details
# verbose = errors + per-request access logs
debug: "off"

# Request fingerprinting — controls how auth2api mimics Claude Code CLI
# These settings affect the User-Agent, billing header, and fingerprint
cloaking:
  # CLI version to impersonate (default: 2.1.88)
  # This affects User-Agent and the fingerprint in billing-header
  cli-version: "2.1.88"

  # Entrypoint for billing attribution (default: cli)
  # Claude Code uses: cli, mcp, sdk, etc.
  entrypoint: "cli"

  # Codex (ChatGPT) provider — protocol-required header strings.
  # NOT identity faking; these mirror what the official codex CLI sends.
  # The cli-version drives BOTH the User-Agent suffix and the explicit
  # `version` HTTP header — the backend version-gates some models on it
  # ("requires a newer version of Codex" 400). Bump if you see that error;
  # `npm view @openai/codex version` shows the current released version.
  codex:
    # Full User-Agent string, takes precedence over the components below.
    # user-agent: "codex_cli_rs/0.125.0 (macos; arm64)"
    originator: "codex_cli_rs"
    cli-version: "0.125.0"
    # Set only if the upstream begins requiring an OpenAI-Beta header.
    # openai-beta: "responses=experimental"

  # Cursor provider — experimental, reverse-engineered, and not official.
  # Override these only when Cursor changes its internal version gates.
  cursor:
    client-version: "2.3.41"
    client-type: "ide"
    # agent-base-url is the legacy alias; both keys point at api2.cursor.sh now.
    agent-base-url: "https://api2.cursor.sh"
    api-base-url: "https://api2.cursor.sh"