LimitFuse
Create a key

PROTECTION API

Use any HTTP client.

Proxy a managed AI call, or reserve budget before a function, queue, database batch, storage job, browser run, build, or paid API call without sharing its key or payload.

Base URL

https://gateway.limitfuse.com/v1

Authentication

Bearer lf_live_...

Server-side only

Never ship project keys to a browser, mobile binary, public repository, log line, or analytics event.

One scoped key per calling product.

Create gateway keys in Integrations. Each key is bound to one organization, project, capability set, and product usage label. Store the plaintext once in that product's secret manager. LimitFuse stores only a keyed digest.

Authorization: Bearer $LIMITFUSE_PROJECT_KEY
The equivalent x-limitfuse-project-key header is also accepted.

ZERO-EMERGENCY MIGRATION

RunFuse is now LimitFuse.

New integrations should use LimitFuse names. Existing integrations remain valid while they migrate: rf_live_ keys, rfa_ receipts, x-runfuse-* headers, /v1/runfuse/* routes, RunFuse metadata, old service origins, and @sansavision/runfuse imports are accepted by the same production state.

Canonical

@sansavision/limitfuse
LimitFuseClient
https://gateway.limitfuse.com
x-limitfuse-*

Still compatible

@sansavision/runfuse
RunFuseClient
https://gateway.runfuse.xyz
x-runfuse-*

Website requests redirect permanently. API, gateway, and MCP origins remain direct aliases because redirecting authenticated POST requests can alter authorization, retry, or method behavior.

Managed gateway.

A direct chat completion resolves the enforcing policy, reserves budget, calls the LimitFuse-managed provider, and settles from provider usage. Include stable operation identity so retries cannot claim new authority.

curl
curl https://gateway.limitfuse.com/v1/chat/completions \
  -H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "limitfuse-default",
    "messages": [
      {"role": "user", "content": "Summarize the support case."}
    ],
    "max_completion_tokens": 500,
    "limitfuse": {
      "feature": "support-triage",
      "operation_id": "case-1842-summary",
      "logical_operation_id": "case-1842-summary",
      "attempt": 1
    }
  }'
server-side fetch
const response = await fetch(
  "https://gateway.limitfuse.com/v1/chat/completions",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.LIMITFUSE_PROJECT_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      model: "limitfuse-default",
      messages: [{ role: "user", content: "Classify this ticket." }],
      max_completion_tokens: 300,
      limitfuse: {
        feature: "support-triage",
        operation_id: crypto.randomUUID(),
        attempt: 1
      }
    })
  }
);

if (!response.ok) {
  const failure = await response.json();
  throw new Error(failure.error?.message ?? "Protected call failed");
}

const completion = await response.json();

METADATA-ONLY CONTROL

Keep your provider key.

External Guard reserves authority before your code runs. Your application then calls its provider or function directly and reports actual cost afterward. LimitFuse receives operational metadata, never the provider key, prompt, request body, or response.

Before execution

Send run identity, operation identity, worst-case cost, retry count, depth, and fanout. A denial means the customer call must not start.

After execution

Settle the signed receipt with actual cost. Cancel only when the provider call definitely did not start. If the outcome is uncertain, keep the reservation and reconcile from authoritative provider logs.

reserve authority
curl https://gateway.limitfuse.com/v1/limitfuse/authorizations \
  -H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "function",
    "feature": "invoice-sync",
    "run_id": "sync-2026-08-28-1842",
    "operation_id": "invoice-1842-attempt-1",
    "logical_operation_id": "invoice-1842",
    "estimated_max_cost_usd": 0.03,
    "attempt": 1,
    "ttl_seconds": 300
  }'
call your provider, then settle
curl https://gateway.limitfuse.com/v1/limitfuse/authorizations/settle \
  -H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "authorization": "lfa_...",
    "actual_cost_usd": 0.0184,
    "price_version": "provider-price-2026-08"
  }'
complete server-side flow
const authorityResponse = await fetch(
  "https://gateway.limitfuse.com/v1/limitfuse/authorizations",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.LIMITFUSE_PROJECT_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      kind: "function",
      feature: "invoice-sync",
      run_id: runId,
      operation_id: operationId,
      logical_operation_id: invoiceId,
      estimated_max_cost_usd: 0.03,
      attempt: 1
    })
  }
);

if (!authorityResponse.ok) {
  // Stop here. The provider or function has not run.
  throw new Error("LimitFuse denied the operation");
}

const { authorization } = await authorityResponse.json();

// Call the provider directly. Its key and payload never enter LimitFuse.
const result = await callYourProvider({ invoiceId });

await fetch(
  "https://gateway.limitfuse.com/v1/limitfuse/authorizations/settle",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.LIMITFUSE_PROJECT_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      authorization,
      actual_cost_usd: result.costUsd
    })
  }
);
hardened raw Fetch flow
const authority = await reserveLimitFuseAuthority();
const deadline = Date.parse(authority.execution_deadline_at);
const controller = new AbortController();
const timer = setTimeout(
  () => controller.abort(new Error("LimitFuse deadline exceeded")),
  Math.max(0, deadline - Date.now())
);
let started = false;

try {
  started = true; // Set immediately before external dispatch.
  const result = await callYourProvider({
    signal: controller.signal,
    maxTokens: 800,
    maxSteps: 6,
    timeoutMs: Math.max(1, deadline - Date.now())
  });
  await settleLimitFuse(authority.authorization, result.costUsd);
} catch (error) {
  if (!started) {
    await cancelLimitFuse(authority.authorization);
    throw error;
  }

  // A timeout after dispatch is uncertain. Never release authority here.
  const stopped = await cancelProviderJob({
    jobId,
    timeoutMs: 5_000
  }).catch(() => ({ confirmed: false }));

  if (stopped.confirmed && stopped.costUsd !== undefined) {
    await settleLimitFuse(authority.authorization, stopped.costUsd);
  } else {
    await enqueueProviderLogReconciliation(authority.operation_id);
  }
} finally {
  clearTimeout(timer);
}
Do not cancel an uncertain call. A network timeout does not prove the provider did no work. Settle from later usage records or allow the short reservation to expire before reconciliation.
Receipt expiry is not a remote kill switch. Every authorization now returns a signed execution_deadline_at ten seconds before expires_at. Enforce that earlier deadline with an abort signal, provider-side limits, and a narrowly scoped termination adapter. The remaining ten seconds are for termination and settlement.
Abort is cooperative. It signals a conforming HTTP client or SDK to stop; it cannot kill code that ignores the signal. Async jobs also need a durable watchdog outside the worker process. If cancellation is not confirmed, preserve the reservation and reconcile provider logs or cloud egress.

CONTROL BOUNDARY

Why an internal guard is safer.

The managed gateway places admission, dispatch, timeout, provider limits, and settlement on one request path. That gives LimitFuse direct control over the in-flight request and authoritative usage evidence. A customer-hosted gateway keeps the same control inside customer infrastructure. External Guard deliberately gives up that direct control so the key and content never enter LimitFuse infrastructure.

MODEADMISSIONIN-FLIGHT DEADLINETERMINATIONSETTLEMENT EVIDENCEBYPASS RESISTANCE
Managed gatewayLimitFuse pathLimitFuse pathDirect when supportedProvider usageHighest
Customer-hosted gatewayCustomer pathCustomer pathDirect when integratedGateway usageHigh
Hardened External GuardCustomer wrapperCustomer runtimeCancel-only adapterReport plus reconciliationDepends on coverage
Basic External GuardCustomer wrapperOften missingNoneCustomer reportLow

Bound the work

Set maximum tokens, steps, job duration, retries, fanout, and a platform runtime limit.

Terminate narrowly

Use a cancel-only credential, signed job-scoped webhook, queue pause, workflow termination, or durable watchdog.

Reconcile uncertainty

Compare operation IDs against provider logs or egress records. Never treat a timeout as proof of zero usage.

Choose hardened External Guard when the trust boundary is non-negotiable. Its limitation is structural: LimitFuse can refuse later authority, but it cannot force an uncooperative process in another system to stop or prove customer-reported cost without an authoritative external record.

Point existing clients at LimitFuse.

Clients that support an OpenAI-compatible base URL can use the managed gateway and a LimitFuse project key. Provider credentials stay in LimitFuse infrastructure. Use External Guard when credentials and content must stay entirely in customer infrastructure.

OpenAI JavaScript client
import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.LIMITFUSE_PROJECT_KEY,
  baseURL: "https://gateway.limitfuse.com/v1"
});

const completion = await client.chat.completions.create({
  model: "limitfuse-default",
  messages: [{ role: "user", content: "Draft the release note." }],
  max_completion_tokens: 400,
  limitfuse: {
    feature: "release-writing",
    operation_id: crypto.randomUUID(),
    attempt: 1
  }
});

Use the helper when it earns its place.

The Node client packages envelope issuance, managed calls, and External Guard. It calls the same public JSON API shown above and is never required.

managed call with @sansavision/limitfuse
import { LimitFuseClient } from "@sansavision/limitfuse";

const limitfuse = new LimitFuseClient({
  gatewayUrl: "https://gateway.limitfuse.com",
  projectKey: process.env.LIMITFUSE_PROJECT_KEY!
});

const run = await limitfuse.createRun({
  organizationId: process.env.LIMITFUSE_ORGANIZATION_ID!,
  projectId: process.env.LIMITFUSE_PROJECT_ID!,
  environment: "production",
  feature: "support-triage"
});

const response = await limitfuse.chatCompletions({
  model: "limitfuse-default",
  messages: [{ role: "user", content: "Summarize the support case." }],
  max_completion_tokens: 500
}, { envelope: run.envelope });
external call with @sansavision/limitfuse
const outcome = await limitfuse.executeExternalSafely({
  kind: "function",
  feature: "invoice-sync",
  runId,
  operationId,
  logicalOperationId: invoiceId,
  estimatedMaxCostUsd: 0.03,
  attempt: 1,
  maxOutputTokens: 800
}, {
  timeoutMs: 45_000,
  execute: async ({ signal, markStarted }) => {
    markStarted();
    const result = await callYourProvider({ invoiceId, signal, maxSteps: 6 });
    return { value: result, actualCostUsd: result.costUsd };
  },
  terminate: async ({ signal }) => {
    const stopped = await cancelProviderJob(jobId, { signal });
    return stopped.confirmed
      ? { status: "confirmed", actualCostUsd: stopped.costUsd }
      : { status: "uncertain" };
  }
});

if (outcome.status === "uncertain") {
  await enqueueProviderLogReconciliation(outcome.authorization.operation_id);
}

AGENT-READABLE · HUMAN-APPROVED

Read-only remote MCP.

Compatible agents can inspect one project, compare managed and external boundaries, prepare an integration or bounded canary, and simulate a fresh operation against an active policy. Create a dedicated mcp:read key; do not reuse a gateway key.

MCP handshake
curl https://mcp.limitfuse.com/mcp \
  -H "Authorization: Bearer $LIMITFUSE_MCP_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"your-agent","version":"1.0"}}}'

What the agent gets

Project posture, policy summaries, recent runs and incidents, integration health, boundary guidance, canary plans, and fresh-run policy simulation.

What it cannot do

No deployment, policy promotion, containment, recovery, key mutation, payment, or other production-changing tool exists on the endpoint.

Endpoint: https://mcp.limitfuse.com/mcp. Authentication uses Authorization: Bearer lf_live_.... Clients that require OAuth discovery instead of a configured Authorization header are not currently supported.

Carry authority across services.

Issue an envelope at the trusted entry point, then pass it through queues, functions, and tools as x-limitfuse-envelope. The signature prevents downstream callers from changing organization, project, run, budget wallet, feature, or economic context.

envelope flow
SIGNED=$(curl -s https://gateway.limitfuse.com/v1/limitfuse/envelopes \
  -H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "environment": "production",
    "feature": "support-triage",
    "tenantId": "tenant_42",
    "economicContext": {
      "expectedRevenueUsd": 1.25,
      "outcomeUnits": 1
    }
  }')

# Base64-encode SIGNED as UTF-8, then send it as x-limitfuse-envelope
# on every child call that belongs to the same causal run.

Internal does not mean invisible.

One organization

Owned products are members of Sansa Vision Internal. Membership and scoped workload identity—not an email string—grant access.

One key per product

Create an Internal workload key per product and environment. Its service, project, cost center, scopes, and hop limit are server-bound.

Zero settlement, full showback

Gross customer-equivalent usage is recorded and fully subsidized. Net amount due remains zero and no payment collection is attempted.

Budgets and containment still apply. Sansa Vision pays the underlying AI and infrastructure cost, so internal sponsorship removes the LimitFuse invoice, not the economic cost of execution. Never send prompts, customer records, request bodies, responses, or credentials to the accounting endpoint.

internal workload showback
curl https://api.limitfuse.com/internal/usage \
  -H "Authorization: Bearer $LIMITFUSE_INTERNAL_WORKLOAD_KEY" \
  -H "Content-Type: application/json" \
  -H "x-sansa-correlation-id: req_01J..." \
  -H "x-sansa-call-chain-id: chain_01J..." \
  -H "x-sansa-visited-services: clipforge" \
  -H "x-sansa-hop-count: 0" \
  -d '{
    "idempotencyKey": "clipforge:req_01J:settlement",
    "billingPhase": "settlement",
    "providerService": "workers-ai",
    "feature": "caption-generation",
    "operation": "generate-caption",
    "provider": "cloudflare",
    "model": "model-version",
    "quantities": { "input_tokens": 420, "output_tokens": 96, "requests": 1 },
    "grossCustomerEquivalentMicros": 840,
    "estimatedInfrastructureCostMicros": 210,
    "source": "cross_service",
    "occurredAt": "2026-08-30T10:00:00.000Z"
  }'
Cross-service contract. Carry a stable correlation ID, originating request ID, call-chain ID, visited-service list, and hop count. LimitFuse rejects tenant mismatches, circular calls, and chains beyond the workload's configured maximum.

Treat decisions as typed outcomes.

HTTPTYPECALLER ACTION
400invalid_json or request_too_largeFix the request. Bodies are limited to 1 MiB.
401authentication_error or envelope_errorReplace the key, or issue a fresh signed envelope.
402limitfuse_policy_deniedThe protected operation was denied before dispatch. Inspect reason and run_id.
403scope_errorThe key cannot act outside its organization and project.
409limitfuse_operation_replayUse one stable operation ID per logical attempt and do not replay authority.
502upstream_unavailableRetry only within the policy limit and preserve the logical operation ID.
503limitfuse_policy_unavailableThe gateway failed closed because authoritative policy could not be resolved.

Managed Payments for external customers.

Paid external plans use Stripe Managed Payments with Link as merchant of record. Checkout, indirect tax calculation and remittance in supported countries, receipts, and transaction support happen on the hosted payment surface. Corporate income tax, payroll tax, and unsupported-country obligations remain LimitFuse's responsibility. Sansavision-sponsored internal accounts never enter checkout.