Voidnet
How the Voidnet routes requests from buyers to publisher servers.
The Voidnet is the central routing layer of the Voidnet Console platform. You send it a request; it authenticates you, enforces your subscription and usage limits, and proxies the request to the publisher's server. You never connect to a publisher directly.
Buyer (API key or JWT) → Voidnet → Publisher's serverWhat the gateway does
- Authenticates your credential (API key or JWT).
- Checks your purchase of the app and your tier's meter.
- Enforces rate limits (per-minute, per-day, monthly meter).
- Routes the request to the publisher's server.
- Returns the publisher's response, or a gateway error if something fails.
You do not need to know the publisher's server URL. The gateway resolves it from the username/appname in your request path.
Endpoint
All app requests go through one endpoint. The adapter in the path selects the protocol:
POST /v1-beta/{adapter}/{username}/{appname}| Parameter | Value |
|---|---|
adapter | mcp (the only available adapter — see Void Apps) |
username | Publisher's public username |
appname | App name, unique per publisher |
Authorization | Bearer <vnb-sk-...>, Bearer <vai-sk-...>, or Bearer <JWT> |
The gateway also supports MCP Streamable HTTP on the same path:
GET— open an SSE stream for server-initiated messages (requiresMcp-Session-Id).DELETE— terminate a session (requiresMcp-Session-Id).
Plus operational endpoints:
| Method | Path | Purpose |
|---|---|---|
GET | /health | Health check (db + redis) |
POST | /oauth/token | Issue JWT access tokens |
GET | /.well-known/oauth-authorization-server | OAuth metadata (RFC 8414) |
GET | /.well-known/oauth-protected-resource | OAuth metadata (RFC 9728) |
GET | /.well-known/jwks.json | Public signing keys |
For the full request/response schema of every operation, see the API Reference — it is generated from the gateway source and cannot drift.
Authentication
Two credential types, both in the Authorization: Bearer header. The gateway auto-detects which you're using:
- API keys (
vnb-sk-*,vai-sk-*) — long-lived, generated in the Console. - JWT access tokens — short-lived (1 hour), obtained from
POST /oauth/token. Use these in production.
A 3-segment (dot-separated) value is treated as a JWT; a vnb-sk-/vai-sk- prefix is treated as an API key.
Errors
All gateway errors use one shape (OAuth endpoints are the exception — see Error Reference):
{
"error": {
"code": "error_code",
"message": "Human-readable description",
"status": 429
}
}