Authentication boundaries
API Key operations require Authorization: Bearer oak_…; account operations use a login session token. Administrator and owner operations also require the matching role. Public endpoints require no OneAster Key or session; Stripe webhooks and NOWPayments IPNs still require their respective official signatures. Internal service APIs are not public.
Idempotency and accounting
POST /v1/chat/completions and POST /v1/tasks require Idempotency-Key. Settled non-streaming chat can replay its original result. Streamed or other recorded chat returns409 request_already_recorded; use X-OneAster-Request-ID to inspect console request logs or GET /core/v1/requests/{id} with an account session. Task replay returns the original task id; changing input returns409. On timeout, disconnect or unknown state, inspect the original record instead of generating a new intent automatically.
1 USD = 100 OneAster credits; 1 credit = 10000 integer accounting units. OneAster _micro fields and amount_usd_cents use decimal integer strings in distinct units; credits retain four-place precision. Provider-currency amounts do not rewrite the original credit quote. Only Core writes wallets. Supplier KIE credits are a different unit.