Constraints

Hard rules that apply across services. Service pages add product-specific limits.

Credentials

Rule	Detail
Full `vh_` keys stay server-side	Never ship unrestricted keys in SPAs, mobile WebViews, or public repos
Prefer scoped keys in browsers	`analytics:ingest`, `crashlytics:ingest`, `messaging:live`, `notifications:register`
Maps in the browser	Use `@vijihub/maps-gl` (no key). Data/admin calls go through your BFF with a full key or JWT
Environment isolation	Keys and tokens only authorize the project/environment in the path

Canonical Maps pattern:

Browser  →  @vijihub/maps-gl          (MapLibre; no vh_)
Browser  →  Your BFF                  (session / JWT)
Your BFF →  @vijihub/maps | Gateway   (full vh_ or JWT)

Path scoping

Almost all product APIs require:

/projects/{projectId}/environments/{environmentId}

Calling another project’s ids returns authorization errors even with a valid key for a different project.

Rate limiting

Auth POSTs (login/register/forgot/reset) use policy vijihub.auth (token bucket by IP).
Other routes may apply API rate-limit policies; treat bursty client retries as unsafe.

Browser SDKs that talk to the Gateway (ingest, messaging hub, device register) rely on Gateway CORS. SignalR messaging uses /messaging/hub with SDK-oriented CORS. Hosting your own origin still requires correct Gateway configuration in deployment.

OpenAPI

In Development, the Gateway serves generated OpenAPI at /openapi/v1.json. It is not a substitute for these docs: curated tables and constraints here are the customer reference. Maps also has a detailed upstream OpenAPI under vijimaps_docs/ (remapped via /maps/public/...).

Usage and quotas

AI, STT, TTS, and Tunneling expose usage endpoints. Enablement and provider capacity still gate real throughput — check Console settings and provider limits.