Skip to main content

Quick start

Services

Configuration

Environment variables

API_KEY_SECRET and QWED_CORS_ORIGINS are mandatory as of v5.0.0. See the deployment guide for the full reference.

API configuration

Docker

API only

Build and run

Kubernetes

🏢 Enterprise Support Coming Soon: Managed hosting, dedicated support, and SLA guarantees. Contact support@qwedai.com

Scaling

Horizontal scaling

  • Stateless API servers behind load balancer
  • Redis for distributed rate limiting
  • PostgreSQL with read replicas

Performance tuning

Monitoring

Health check

Prometheus metrics

Scrape GET /metrics/prometheus (the Prometheus text exposition format — /metrics returns JSON). The endpoint requires a platform operator: create a dedicated scraper account, add its user ID to QWED_METRICS_OPERATOR_USER_IDS (fail-closed when unset — every caller is denied, including org owners/admins), mint the account an API key, and send it as a header on the scrape. See All-tenant metrics authorization.

Security

  1. Always use HTTPS in production
  2. Set API_KEY_SECRET — mandatory, no default value
  3. Set QWED_CORS_ORIGINS — mandatory, explicitly list allowed origins
  4. Set strong API keys
  5. Enable rate limiting
  6. Use network isolation
  7. Rotate secrets regularly
  8. Configure QWED_METRICS_OPERATOR_USER_IDS if anything needs all-tenant metrics — unset means deny-all