feat: Add versioned /api/v1 endpoints with secure auth, credit tracking, and usage auditing

[samarth30]

This pull request introduces a new versioned API under the /api/v1/ namespace, focusing on secure, auditable, and credit-aware endpoints for API key management, chat, image, and video generation. It implements robust authentication (supporting both user and API key auth), usage tracking, and credit deduction for resource-intensive operations. Several legacy or debug endpoints are removed or refactored for consistency.

The most important changes are:

API Key Management (CRUD):

• Added endpoints for creating, listing, updating, deleting, and regenerating API keys, all protected by authentication and organization-scoped authorization. These endpoints ensure only authorized users can manage keys for their organization and provide detailed error handling. (app/api/v1/api-keys/route.ts, app/api/v1/api-keys/[id]/route.ts, app/api/v1/api-keys/[id]/regenerate/route.ts) (app/api/v1/api-keys/route.tsR1-R60, app/api/v1/api-keys/[id]/route.tsR1-R86, app/api/v1/api-keys/[id]/regenerate/route.tsR1-R56)

AI Generation Endpoints (Chat, Image, Video):

• Introduced new /api/v1/chat, /api/v1/generate-image, and /api/v1/generate-video endpoints, all requiring either user or API key authentication. These endpoints deduct credits for each operation, record detailed usage for billing/auditing, and handle errors gracefully (including fallback responses for video generation failures). (app/api/v1/chat/route.ts, app/api/v1/generate-image/route.ts, app/api/v1/generate-video/route.ts) [1] [2] [3]
• The chat and image endpoints now record which API key (if any) was used for the request. [1] [2] [3]

Model Listing Endpoint:

• Updated the models listing endpoint to require authentication and moved it to /api/v1/models. (app/api/v1/models/route.ts)

Third-Party Proxy and Debug Cleanup:

• Added a proxy route for FAL AI service integration. (app/api/fal/proxy/route.ts)
• Removed the legacy debug user endpoint. (app/api/debug/user/route.ts)
• Removed the old image generation endpoint in favor of the new versioned one. (app/api/generate-image/route.ts)

These changes collectively provide a secure, scalable, and auditable foundation for API consumers and internal users, ensuring resource usage is tracked and billed appropriately.

[vercel]

@samarth30 is attempting to deploy a commit to the elizaOS team on Vercel, but is not a member of this team. To resolve this issue, you can:

• Make your repository public. Collaboration is free for open source and public repositories.
• Add @samarth30 as a member. A Pro subscription is required to access Vercel's collaborative features.
  • If you're the owner of the team, click here and add @samarth30 as a member.
  • If you're the user who initiated this build request, click here to request access.
  • If you're already a member of the elizaOS team, make sure that your Vercel account is connected to your GitHub account.

To read more about collaboration on Vercel, click here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull Request Overview

This pull request introduces a comprehensive versioned API (/api/v1/) with secure authentication, comprehensive API key management, credit tracking, and usage auditing. The changes establish a robust foundation for API consumers by implementing dual authentication (user sessions and API keys), credit-based resource consumption tracking, and detailed usage analytics.

Key changes include:

• Complete API key CRUD management with regeneration capabilities and permission-based access control
• Secure versioned endpoints for chat, image, and video generation with credit deduction and usage tracking
• Enhanced authentication system supporting both session-based and API key-based access
• Video generation capabilities with FAL AI integration and fallback mechanisms

Reviewed Changes

Copilot reviewed 58 out of 59 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
lib/auth.ts	Adds dual authentication system supporting both user sessions and API keys with comprehensive validation
app/api/v1/api-keys/	Implements complete CRUD operations for API key management with organization-scoped security
app/api/v1/generate-*	Creates secure generation endpoints with credit tracking and usage auditing
components/api-keys/	Provides comprehensive UI for API key management with proper security practices
components/video/	Adds complete video generation interface with real-time preview and usage tracking

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
eliza-cloud-v2	Ready	Preview	Comment	Oct 4, 2025 3:47am