Changelog

API keys

The Better Auth apiKey plugin is now wired to /v1/* routes. Every request must arrive with Authorization: Bearer ak_…. Keys are scoped to a workspace and can be revoked from the dashboard.

• Keys are hashed at rest; the raw value is shown exactly once on creation.
• Per-key metadata records last-used timestamp and origin IP for the most recent N calls.

Credits accounting

The credits module now bills generation jobs at submit time and refunds on terminal failure.

• Submit: insert a USAGE row equal to the model's listed price, debit the user balance.
• Succeeded: no further action — the debit stands.
• Failed / cancelled: insert an offsetting transaction with reason REFUND_FAILED_JOB; balance restored.
• The webhook handler and worker share the same settleJob() helper so the bookkeeping is identical regardless of which path completes the job.

Rate limiting

Per-API-key sliding window limits enforced via Postgres (request_log) — no Redis dependency for the MVP. Defaults:

• Free plan keys: 60 requests / minute.
• Pro plan keys: 600 requests / minute.
• Lifetime plan keys: 600 requests / minute.

What's next

Week 4 starts on the public API surface: OpenAPI spec, SSE for /v1/jobs/:id/stream, and the first cut of the @genace/agent-video Claude Code skill.

Async job worker

Generation requests no longer block the HTTP request. The worker picks up queued jobs from Postgres, calls the relevant provider, and parks the job in running until the upstream finishes.

• Backoff with jitter on upstream 5xx / transient errors — capped at 6 attempts per job.
• Visibility timeout so a crashed worker doesn't strand a job forever; another worker can reclaim it after 60s.
• Per-provider concurrency caps read from the model registry, so a noisy Veo 3 burst can't starve Flux Pro.

fal.ai webhook ingestion

The webhook handler under /api/webhooks/fal verifies the x-fal-signature HMAC against the project secret, then writes the result to the job row and the asset table in a single transaction.

• Replay attempts are rejected via the timestamp + nonce check.
• Failed verification logs to the ops Discord channel and is dropped — no 5xx so fal.ai stops retrying.

Quality of life

• /v1/jobs/:id now returns the same shape whether the job is in queued, running, succeeded, or failed.
• Job rows carry a provider_meta JSONB so we can debug upstream IDs without an extra round trip.

What's next

Week 3 turns on real auth: API keys, credit deduction with refund-on-failure, and per-key rate limits.

Highlights

The first internal cut of Genace. Nothing user-facing yet — this release lays the plumbing every model integration relies on for the rest of the MVP.

• Provider adapter pattern: a single Provider interface (submit, pollJob, parseWebhook) sits in front of every upstream. Day-one implementation targets fal.ai.
• Model registry: registry/models.ts declares each supported model with capabilities, default params, and price-per-call. Currently registered: Seedance 2.0 fast, Kling 2.0, Veo 3 (video) and Flux Pro, Nano Banana, Ideogram v3 (image).
• Shared types: GenerationRequest, GenerationJob, and provider-agnostic asset shapes live in src/ai/types.ts so the API, worker, and Claude Code skill all speak the same language.

Technical notes

• All providers normalize to the same JobStatus enum — queued | running | succeeded | failed | cancelled.
• Idempotency key plumbed end-to-end so retries from the agent SDK don't double-charge credits.
• Database schema for generation_job / generation_asset lands in this release via Drizzle migrations.

What's next

Week 2 brings the async worker, fal.ai webhook signature verification, and the first /v1/generations endpoint behind an API key.