VoidnetVoid Docs

Voidnet

How the Voidnet routes requests from buyers to publisher servers.

The Voidnet is the central routing layer of the Voidnet Console platform. You send it a request; it authenticates you, enforces your subscription and usage limits, and proxies the request to the publisher's server. You never connect to a publisher directly.

Buyer (API key or JWT)  →  Voidnet  →  Publisher's server

What the gateway does

  1. Authenticates your credential (API key or JWT).
  2. Checks your purchase of the app and your tier's meter.
  3. Enforces rate limits (per-minute, per-day, monthly meter).
  4. Routes the request to the publisher's server.
  5. Returns the publisher's response, or a gateway error if something fails.

You do not need to know the publisher's server URL. The gateway resolves it from the username/appname in your request path.

Endpoint

All app requests go through one endpoint. The adapter in the path selects the protocol:

POST /v1-beta/{adapter}/{username}/{appname}
ParameterValue
adaptermcp (the only available adapter — see Void Apps)
usernamePublisher's public username
appnameApp name, unique per publisher
AuthorizationBearer <vnb-sk-...>, Bearer <vai-sk-...>, or Bearer <JWT>

The gateway also supports MCP Streamable HTTP on the same path:

  • GET — open an SSE stream for server-initiated messages (requires Mcp-Session-Id).
  • DELETE — terminate a session (requires Mcp-Session-Id).

Plus operational endpoints:

MethodPathPurpose
GET/healthHealth check (db + redis)
POST/oauth/tokenIssue JWT access tokens
GET/.well-known/oauth-authorization-serverOAuth metadata (RFC 8414)
GET/.well-known/oauth-protected-resourceOAuth metadata (RFC 9728)
GET/.well-known/jwks.jsonPublic signing keys

For the full request/response schema of every operation, see the API Reference — it is generated from the gateway source and cannot drift.

Authentication

Two credential types, both in the Authorization: Bearer header. The gateway auto-detects which you're using:

  • API keys (vnb-sk-*, vai-sk-*) — long-lived, generated in the Console.
  • JWT access tokens — short-lived (1 hour), obtained from POST /oauth/token. Use these in production.

A 3-segment (dot-separated) value is treated as a JWT; a vnb-sk-/vai-sk- prefix is treated as an API key.

Errors

All gateway errors use one shape (OAuth endpoints are the exception — see Error Reference):

{
  "error": {
    "code": "error_code",
    "message": "Human-readable description",
    "status": 429
  }
}

On this page