One scoped key per calling product.
Create gateway keys in Integrations. Each key is bound to one organization, project, capability set, and product usage label. Store the plaintext once in that product's secret manager. LimitFuse stores only a keyed digest.
Authorization: Bearer $LIMITFUSE_PROJECT_KEYThe equivalent
x-limitfuse-project-key header is also accepted.ZERO-EMERGENCY MIGRATION
RunFuse is now LimitFuse.
New integrations should use LimitFuse names. Existing integrations remain valid while they migrate: rf_live_ keys, rfa_ receipts, x-runfuse-* headers, /v1/runfuse/* routes, RunFuse metadata, old service origins, and @sansavision/runfuse imports are accepted by the same production state.
Canonical
@sansavision/limitfuseLimitFuseClienthttps://gateway.limitfuse.comx-limitfuse-*
Still compatible
@sansavision/runfuseRunFuseClienthttps://gateway.runfuse.xyzx-runfuse-*
Website requests redirect permanently. API, gateway, and MCP origins remain direct aliases because redirecting authenticated POST requests can alter authorization, retry, or method behavior.
Managed gateway.
A direct chat completion resolves the enforcing policy, reserves budget, calls the LimitFuse-managed provider, and settles from provider usage. Include stable operation identity so retries cannot claim new authority.
curl https://gateway.limitfuse.com/v1/chat/completions \
-H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "limitfuse-default",
"messages": [
{"role": "user", "content": "Summarize the support case."}
],
"max_completion_tokens": 500,
"limitfuse": {
"feature": "support-triage",
"operation_id": "case-1842-summary",
"logical_operation_id": "case-1842-summary",
"attempt": 1
}
}'const response = await fetch(
"https://gateway.limitfuse.com/v1/chat/completions",
{
method: "POST",
headers: {
Authorization: `Bearer ${process.env.LIMITFUSE_PROJECT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
model: "limitfuse-default",
messages: [{ role: "user", content: "Classify this ticket." }],
max_completion_tokens: 300,
limitfuse: {
feature: "support-triage",
operation_id: crypto.randomUUID(),
attempt: 1
}
})
}
);
if (!response.ok) {
const failure = await response.json();
throw new Error(failure.error?.message ?? "Protected call failed");
}
const completion = await response.json();METADATA-ONLY CONTROL
Keep your provider key.
External Guard reserves authority before your code runs. Your application then calls its provider or function directly and reports actual cost afterward. LimitFuse receives operational metadata, never the provider key, prompt, request body, or response.
Before execution
Send run identity, operation identity, worst-case cost, retry count, depth, and fanout. A denial means the customer call must not start.
After execution
Settle the signed receipt with actual cost. Cancel only when the provider call definitely did not start. If the outcome is uncertain, keep the reservation and reconcile from authoritative provider logs.
curl https://gateway.limitfuse.com/v1/limitfuse/authorizations \
-H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
-H "Content-Type: application/json" \
-d '{
"kind": "function",
"feature": "invoice-sync",
"run_id": "sync-2026-08-28-1842",
"operation_id": "invoice-1842-attempt-1",
"logical_operation_id": "invoice-1842",
"estimated_max_cost_usd": 0.03,
"attempt": 1,
"ttl_seconds": 300
}'curl https://gateway.limitfuse.com/v1/limitfuse/authorizations/settle \
-H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
-H "Content-Type: application/json" \
-d '{
"authorization": "lfa_...",
"actual_cost_usd": 0.0184,
"price_version": "provider-price-2026-08"
}'const authorityResponse = await fetch(
"https://gateway.limitfuse.com/v1/limitfuse/authorizations",
{
method: "POST",
headers: {
Authorization: `Bearer ${process.env.LIMITFUSE_PROJECT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
kind: "function",
feature: "invoice-sync",
run_id: runId,
operation_id: operationId,
logical_operation_id: invoiceId,
estimated_max_cost_usd: 0.03,
attempt: 1
})
}
);
if (!authorityResponse.ok) {
// Stop here. The provider or function has not run.
throw new Error("LimitFuse denied the operation");
}
const { authorization } = await authorityResponse.json();
// Call the provider directly. Its key and payload never enter LimitFuse.
const result = await callYourProvider({ invoiceId });
await fetch(
"https://gateway.limitfuse.com/v1/limitfuse/authorizations/settle",
{
method: "POST",
headers: {
Authorization: `Bearer ${process.env.LIMITFUSE_PROJECT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
authorization,
actual_cost_usd: result.costUsd
})
}
);const authority = await reserveLimitFuseAuthority();
const deadline = Date.parse(authority.execution_deadline_at);
const controller = new AbortController();
const timer = setTimeout(
() => controller.abort(new Error("LimitFuse deadline exceeded")),
Math.max(0, deadline - Date.now())
);
let started = false;
try {
started = true; // Set immediately before external dispatch.
const result = await callYourProvider({
signal: controller.signal,
maxTokens: 800,
maxSteps: 6,
timeoutMs: Math.max(1, deadline - Date.now())
});
await settleLimitFuse(authority.authorization, result.costUsd);
} catch (error) {
if (!started) {
await cancelLimitFuse(authority.authorization);
throw error;
}
// A timeout after dispatch is uncertain. Never release authority here.
const stopped = await cancelProviderJob({
jobId,
timeoutMs: 5_000
}).catch(() => ({ confirmed: false }));
if (stopped.confirmed && stopped.costUsd !== undefined) {
await settleLimitFuse(authority.authorization, stopped.costUsd);
} else {
await enqueueProviderLogReconciliation(authority.operation_id);
}
} finally {
clearTimeout(timer);
}execution_deadline_at ten seconds before expires_at. Enforce that earlier deadline with an abort signal, provider-side limits, and a narrowly scoped termination adapter. The remaining ten seconds are for termination and settlement.CONTROL BOUNDARY
Why an internal guard is safer.
The managed gateway places admission, dispatch, timeout, provider limits, and settlement on one request path. That gives LimitFuse direct control over the in-flight request and authoritative usage evidence. A customer-hosted gateway keeps the same control inside customer infrastructure. External Guard deliberately gives up that direct control so the key and content never enter LimitFuse infrastructure.
| MODE | ADMISSION | IN-FLIGHT DEADLINE | TERMINATION | SETTLEMENT EVIDENCE | BYPASS RESISTANCE |
|---|---|---|---|---|---|
| Managed gateway | LimitFuse path | LimitFuse path | Direct when supported | Provider usage | Highest |
| Customer-hosted gateway | Customer path | Customer path | Direct when integrated | Gateway usage | High |
| Hardened External Guard | Customer wrapper | Customer runtime | Cancel-only adapter | Report plus reconciliation | Depends on coverage |
| Basic External Guard | Customer wrapper | Often missing | None | Customer report | Low |
Bound the work
Set maximum tokens, steps, job duration, retries, fanout, and a platform runtime limit.
Terminate narrowly
Use a cancel-only credential, signed job-scoped webhook, queue pause, workflow termination, or durable watchdog.
Reconcile uncertainty
Compare operation IDs against provider logs or egress records. Never treat a timeout as proof of zero usage.
Choose hardened External Guard when the trust boundary is non-negotiable. Its limitation is structural: LimitFuse can refuse later authority, but it cannot force an uncooperative process in another system to stop or prove customer-reported cost without an authoritative external record.
Point existing clients at LimitFuse.
Clients that support an OpenAI-compatible base URL can use the managed gateway and a LimitFuse project key. Provider credentials stay in LimitFuse infrastructure. Use External Guard when credentials and content must stay entirely in customer infrastructure.
import OpenAI from "openai";
const client = new OpenAI({
apiKey: process.env.LIMITFUSE_PROJECT_KEY,
baseURL: "https://gateway.limitfuse.com/v1"
});
const completion = await client.chat.completions.create({
model: "limitfuse-default",
messages: [{ role: "user", content: "Draft the release note." }],
max_completion_tokens: 400,
limitfuse: {
feature: "release-writing",
operation_id: crypto.randomUUID(),
attempt: 1
}
});Use the helper when it earns its place.
The Node client packages envelope issuance, managed calls, and External Guard. It calls the same public JSON API shown above and is never required.
import { LimitFuseClient } from "@sansavision/limitfuse";
const limitfuse = new LimitFuseClient({
gatewayUrl: "https://gateway.limitfuse.com",
projectKey: process.env.LIMITFUSE_PROJECT_KEY!
});
const run = await limitfuse.createRun({
organizationId: process.env.LIMITFUSE_ORGANIZATION_ID!,
projectId: process.env.LIMITFUSE_PROJECT_ID!,
environment: "production",
feature: "support-triage"
});
const response = await limitfuse.chatCompletions({
model: "limitfuse-default",
messages: [{ role: "user", content: "Summarize the support case." }],
max_completion_tokens: 500
}, { envelope: run.envelope });const outcome = await limitfuse.executeExternalSafely({
kind: "function",
feature: "invoice-sync",
runId,
operationId,
logicalOperationId: invoiceId,
estimatedMaxCostUsd: 0.03,
attempt: 1,
maxOutputTokens: 800
}, {
timeoutMs: 45_000,
execute: async ({ signal, markStarted }) => {
markStarted();
const result = await callYourProvider({ invoiceId, signal, maxSteps: 6 });
return { value: result, actualCostUsd: result.costUsd };
},
terminate: async ({ signal }) => {
const stopped = await cancelProviderJob(jobId, { signal });
return stopped.confirmed
? { status: "confirmed", actualCostUsd: stopped.costUsd }
: { status: "uncertain" };
}
});
if (outcome.status === "uncertain") {
await enqueueProviderLogReconciliation(outcome.authorization.operation_id);
}AGENT-READABLE · HUMAN-APPROVED
Read-only remote MCP.
Compatible agents can inspect one project, compare managed and external boundaries, prepare an integration or bounded canary, and simulate a fresh operation against an active policy. Create a dedicated mcp:read key; do not reuse a gateway key.
curl https://mcp.limitfuse.com/mcp \
-H "Authorization: Bearer $LIMITFUSE_MCP_KEY" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
--data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"your-agent","version":"1.0"}}}'What the agent gets
Project posture, policy summaries, recent runs and incidents, integration health, boundary guidance, canary plans, and fresh-run policy simulation.
What it cannot do
No deployment, policy promotion, containment, recovery, key mutation, payment, or other production-changing tool exists on the endpoint.
Endpoint: https://mcp.limitfuse.com/mcp. Authentication uses Authorization: Bearer lf_live_.... Clients that require OAuth discovery instead of a configured Authorization header are not currently supported.
Carry authority across services.
Issue an envelope at the trusted entry point, then pass it through queues, functions, and tools as x-limitfuse-envelope. The signature prevents downstream callers from changing organization, project, run, budget wallet, feature, or economic context.
SIGNED=$(curl -s https://gateway.limitfuse.com/v1/limitfuse/envelopes \
-H "Authorization: Bearer $LIMITFUSE_PROJECT_KEY" \
-H "Content-Type: application/json" \
-d '{
"environment": "production",
"feature": "support-triage",
"tenantId": "tenant_42",
"economicContext": {
"expectedRevenueUsd": 1.25,
"outcomeUnits": 1
}
}')
# Base64-encode SIGNED as UTF-8, then send it as x-limitfuse-envelope
# on every child call that belongs to the same causal run.Internal does not mean invisible.
One organization
Owned products are members of Sansa Vision Internal. Membership and scoped workload identity—not an email string—grant access.
One key per product
Create an Internal workload key per product and environment. Its service, project, cost center, scopes, and hop limit are server-bound.
Zero settlement, full showback
Gross customer-equivalent usage is recorded and fully subsidized. Net amount due remains zero and no payment collection is attempted.
Budgets and containment still apply. Sansa Vision pays the underlying AI and infrastructure cost, so internal sponsorship removes the LimitFuse invoice, not the economic cost of execution. Never send prompts, customer records, request bodies, responses, or credentials to the accounting endpoint.
curl https://api.limitfuse.com/internal/usage \
-H "Authorization: Bearer $LIMITFUSE_INTERNAL_WORKLOAD_KEY" \
-H "Content-Type: application/json" \
-H "x-sansa-correlation-id: req_01J..." \
-H "x-sansa-call-chain-id: chain_01J..." \
-H "x-sansa-visited-services: clipforge" \
-H "x-sansa-hop-count: 0" \
-d '{
"idempotencyKey": "clipforge:req_01J:settlement",
"billingPhase": "settlement",
"providerService": "workers-ai",
"feature": "caption-generation",
"operation": "generate-caption",
"provider": "cloudflare",
"model": "model-version",
"quantities": { "input_tokens": 420, "output_tokens": 96, "requests": 1 },
"grossCustomerEquivalentMicros": 840,
"estimatedInfrastructureCostMicros": 210,
"source": "cross_service",
"occurredAt": "2026-08-30T10:00:00.000Z"
}'Treat decisions as typed outcomes.
| HTTP | TYPE | CALLER ACTION |
|---|---|---|
| 400 | invalid_json or request_too_large | Fix the request. Bodies are limited to 1 MiB. |
| 401 | authentication_error or envelope_error | Replace the key, or issue a fresh signed envelope. |
| 402 | limitfuse_policy_denied | The protected operation was denied before dispatch. Inspect reason and run_id. |
| 403 | scope_error | The key cannot act outside its organization and project. |
| 409 | limitfuse_operation_replay | Use one stable operation ID per logical attempt and do not replay authority. |
| 502 | upstream_unavailable | Retry only within the policy limit and preserve the logical operation ID. |
| 503 | limitfuse_policy_unavailable | The gateway failed closed because authoritative policy could not be resolved. |
Managed Payments for external customers.
Paid external plans use Stripe Managed Payments with Link as merchant of record. Checkout, indirect tax calculation and remittance in supported countries, receipts, and transaction support happen on the hosted payment surface. Corporate income tax, payroll tax, and unsupported-country obligations remain LimitFuse's responsibility. Sansavision-sponsored internal accounts never enter checkout.