BYO keys and tiers

Pipeworx has two layers of authentication, and they’re independent:

1. Gateway tier — your auth to Pipeworx (controls daily call quota)
2. Pack-level keys — keys for paid upstream sources (FRED, ATTOM, Altos, etc.) passed per-call as _apiKey

Gateway tiers

Resolution priority: Bearer token > X-API-Key > anonymous fallback. The gateway returns your effective tier in _meta.tier on every response.

Per-tool _apiKey

Some packs wrap upstream APIs that have their own keys (FRED, ATTOM, Altos, Alpha Vantage, etc.). The pack’s inputSchema declares an _apiKey argument. You pass the key per call:

fred_get_series({
  series_id: "MORTGAGE30US",
  _apiKey: "your-fred-api-key"
})

The _apiKey arg is stripped from analytics — it’s not logged with your usage data. It’s forwarded only to the upstream provider.

Why two layers?

• Pipeworx as a service has a tier system to fund the gateway’s hosting (CF Workers, KV, Anthropic for ask_pipeworx, etc.).
• Some upstream providers (FRED, ATTOM, Altos) require the caller’s key for their own auth/billing. Pipeworx doesn’t proxy these — you pass through.

For free upstream sources (SEC EDGAR, ClinicalTrials.gov, RxNorm, USPTO, Census, BLS, etc.), no _apiKey is needed. Just call.

Vertical bundling

Pipeworx Verticals (Housing, FinTech, etc.) can include managed access to paid sources. Subscribing to a vertical at pipeworx.io/account gives your account a single Bearer token that covers both the gateway tier and the upstream keys — Pipeworx fronts the upstream relationship.

So an account with a Housing Vertical subscription can call attom_avm without passing _apiKey — the gateway substitutes the managed key.

Get a free account

Sign up at pipeworx.io with GitHub. You get:

• 2,000 calls/day (vs 50 anonymous)
• Persistent remember / recall memory (vs 24-hour TTL)
• Account-scoped credit transactions visible at pipeworx.io/account
• The ability to subscribe to verticals

Get a paid account

Same Bearer token, unmetered usage with budget controls. Set up at pipeworx.io/account.

Quick auth checklist