A fixed door between your app and one API key.

Create a route, get a token. The token only ever reaches the one URL you locked it to.

Connection

Start from a preset Label Inject secret as Base URL Callers can add any path under this URL, like /chat/completions. Nothing outside it is reachable. Header / parameter name Secret value

Who can call it origins, methods, paths, IPs

Allowed browser origins Allowed methods Allowed paths Allowed caller IPs Use this for server-side callers. Origins only restrict browsers. Require human verification (Cloudflare Turnstile) Callers send the Turnstile token in the X-Turnstile-Token header and get a short-lived pass back. Needs TURNSTILE_SECRET on the Worker.

Limits and reliability rate, timeout, retries

Rate limit per minute (whole route) Per-caller limit per minute (0 = off) Timeout (seconds) Retries on 502/503/504 (GET, HEAD)

Upstream headers sent with every request

One per line Stored as plain text. Put secrets in the secret field, not here.