feat: update footer

.mcp.json

@@ -25,7 +25,7 @@
       "command": "docker",
       "args": ["run", "-i", "--rm", "-e", "DATABASE_URI", "crystaldba/postgres-mcp", "--access-mode=unrestricted"],
       "env": {
-        "DATABASE_URI": "postgresql://postgres:postgres@localhost:5433/prime_db"
+        "DATABASE_URI": "postgresql://postgres:postgres@localhost:5434/banatie_db"
       }
     },
     "mastra": {

CLAUDE.md

@@ -56,6 +56,8 @@ banatie-service/
 │   ├── landing/         # Next.js landing page
 │   ├── studio/          # Next.js SaaS platform
 │   └── admin/           # Next.js admin dashboard
+├── packages/
+│   └── database/        # Shared database package (Drizzle ORM)
 ├── data/                # Docker volume data (postgres, minio)
 ├── docker-compose.yml   # Infrastructure services
 ├── pnpm-workspace.yaml  # Workspace configuration
@@ -66,15 +68,23 @@ banatie-service/
 
 - **Express App**: Configured in `src/app.ts` with middleware, CORS, and route mounting
 - **Server Entry**: `src/server.ts` starts the HTTP server
-- **Image Generation**: `src/services/ImageGenService.ts` handles Gemini AI integration
-- **Storage**: `src/services/MinioStorageService.ts` handles file uploads to MinIO
-- **Route Handling**: `src/routes/generate.ts` contains the main API endpoint logic
+- **Database Client**: `src/db.ts` - Drizzle ORM connection to PostgreSQL
+- **Authentication**: `src/services/ApiKeyService.ts` - API key management and validation
+- **Image Generation**: `src/services/ImageGenService.ts` - Gemini AI integration
+- **Storage**: `src/services/MinioStorageService.ts` - File uploads to MinIO
+- **Route Handling**:
+  - `src/routes/bootstrap.ts` - Bootstrap initial master key (one-time)
+  - `src/routes/admin/keys.ts` - API key management (master key required)
+  - `src/routes/generate.ts` - Image generation endpoint (API key required)
 
 ### Middleware Stack (API Service)
 
 - `src/middleware/upload.ts` - Multer configuration for file uploads (max 3 files, 5MB each)
 - `src/middleware/validation.ts` - Express-validator for request validation
 - `src/middleware/errorHandler.ts` - Centralized error handling and 404 responses
+- `src/middleware/auth/validateApiKey.ts` - API key authentication
+- `src/middleware/auth/requireMasterKey.ts` - Master key authorization
+- `src/middleware/auth/rateLimiter.ts` - Rate limiting per API key (100 req/hour)
 
 ### TypeScript Configuration (API Service)
 
@@ -89,13 +99,32 @@ banatie-service/
 ### Storage & Data
 
 - **MinIO**: Object storage for generated images and uploads (port 9000)
-- **PostgreSQL**: Database for user data, metadata (port 5434)
+- **PostgreSQL**: Database for API keys, user data, and metadata (port 5434)
+  - Database name: `banatie_db`
+  - User: `banatie_user`
+  - Tables: `api_keys`, `organizations`, `projects`, `users`, `images`, `upload_sessions`
 - **File Organization**: `orgId/projectId/category/year-month/filename.ext`
 
+### Database Package (`packages/database/`)
+
+Shared Drizzle ORM package used by API service and future apps:
+
+- **Schema**: `src/schema/apiKeys.ts` - API keys table definition
+- **Client Factory**: `src/client.ts` - Database connection creator
+- **Migrations**: `migrations/` - SQL migration files
+- **Configuration**: `drizzle.config.ts` - Drizzle Kit configuration
+
+Key table: `api_keys`
+- Stores hashed API keys (SHA-256)
+- Two types: `master` (admin, never expires) and `project` (90-day expiration)
+- Soft delete via `is_active` flag
+- Audit trail with `createdBy`, `lastUsedAt`, `createdAt`
+
 ## Environment Configuration
 
 ### Root Environment (`.env.docker`)
 
+- `DATABASE_URL` - PostgreSQL connection string (for Docker: `postgresql://banatie_user:banatie_secure_password@postgres:5432/banatie_db`)
 - `MINIO_ROOT_USER` - MinIO admin username
 - `MINIO_ROOT_PASSWORD` - MinIO admin password
 
@@ -103,6 +132,7 @@ banatie-service/
 
 Required environment variables:
 
+- `DATABASE_URL` - PostgreSQL connection string (for local dev: `postgresql://banatie_user:banatie_secure_password@localhost:5434/banatie_db`)
 - `GEMINI_API_KEY` - Google Gemini API key (required)
 - `MINIO_ENDPOINT` - MinIO endpoint (`localhost:9000` for local dev, `minio:9000` for Docker)
 - `MINIO_ACCESS_KEY` - MinIO service account key
@@ -110,20 +140,28 @@ Required environment variables:
 - `MINIO_BUCKET_NAME` - Storage bucket name (default: `banatie`)
 - `PORT` - Server port (default: 3000)
 - `NODE_ENV` - Environment mode
-- `CORS_ORIGIN` - CORS origin setting (default: \*)
+- `CORS_ORIGIN` - CORS origin setting (default: multiple localhost URLs for frontend apps)
 
 ## Key Dependencies
 
 ### API Service
 
+- **@banatie/database** - Shared database package (workspace dependency)
 - **@google/genai** - Google Gemini AI client
+- **drizzle-orm** - TypeScript ORM (via database package)
+- **postgres** - PostgreSQL client for Node.js (via database package)
 - **express** v5 - Web framework
 - **multer** - File upload handling
 - **minio** - MinIO client for object storage
 - **express-validator** - Request validation
 - **winston** - Logging
 - **helmet** - Security middleware
-- **express-rate-limit** - Rate limiting
+
+### Database Package
+
+- **drizzle-orm** - TypeScript ORM for SQL databases
+- **drizzle-kit** - CLI tools for migrations
+- **postgres** - PostgreSQL client for Node.js
 
 ### Frontend Apps (Next.js)
 
@@ -147,9 +185,59 @@ Required environment variables:
 
 ## API Endpoints (API Service)
 
+### Public Endpoints (No Authentication)
 - `GET /health` - Health check with uptime and status
 - `GET /api/info` - API information and limits
-- `POST /api/generate` - Main image generation endpoint (multipart/form-data)
+- `POST /api/bootstrap/initial-key` - Create first master key (one-time only)
+
+### Admin Endpoints (Master Key Required)
+- `POST /api/admin/keys` - Create new API keys (master or project)
+- `GET /api/admin/keys` - List all API keys
+- `DELETE /api/admin/keys/:keyId` - Revoke an API key
+
+### Protected Endpoints (API Key Required)
+- `POST /api/generate` - Generate images from text + optional reference images
+- `POST /api/text-to-image` - Generate images from text only (JSON)
+- `POST /api/enhance` - Enhance and optimize text prompts
+- `GET /api/images` - List generated images
+
+**Authentication**: All protected endpoints require `X-API-Key` header
+
+## Authentication Setup
+
+### First-Time Setup
+
+1. **Start Services**: `docker compose up -d`
+2. **Create Master Key**:
+   ```bash
+   curl -X POST http://localhost:3000/api/bootstrap/initial-key
+   ```
+   Save the returned key securely!
+
+3. **Create Project Key** (for testing):
+   ```bash
+   curl -X POST http://localhost:3000/api/admin/keys \
+     -H "X-API-Key: YOUR_MASTER_KEY" \
+     -H "Content-Type: application/json" \
+     -d '{"type": "project", "projectId": "test", "name": "Test Key"}'
+   ```
+
+### Using API Keys
+
+```bash
+# Image generation with project key
+curl -X POST http://localhost:3000/api/generate \
+  -H "X-API-Key: YOUR_PROJECT_KEY" \
+  -F "prompt=a sunset" \
+  -F "filename=test_image"
+```
+
+### Key Management
+
+- **Master Keys**: Never expire, can create/revoke other keys, admin access
+- **Project Keys**: Expire in 90 days, for image generation only
+- **Rate Limits**: 100 requests per hour per key
+- **Revocation**: Soft delete via `is_active` flag
 
 ## Development Notes
 
@@ -159,3 +247,4 @@ Required environment variables:
 - ESLint configured with TypeScript and Prettier integration
 - Jest for testing with ts-jest preset (API service)
 - Each app can be developed and deployed independently
+- **Docker**: Uses monorepo-aware Dockerfile (`Dockerfile.mono`) that includes workspace packages

apps/api-service/src/routes/enhance.ts

@@ -7,6 +7,8 @@ import {
   PromptEnhancementResponse,
 } from "../types/api";
 import { body, validationResult } from "express-validator";
+import { validateApiKey } from "../middleware/auth/validateApiKey";
+import { rateLimitByApiKey } from "../middleware/auth/rateLimiter";
 
 export const enhanceRouter: RouterType = Router();
 
@@ -88,6 +90,9 @@ const logEnhanceRequest = (req: Request, _res: Response, next: Function) => {
 
 enhanceRouter.post(
   "/enhance",
+  // Authentication middleware
+  validateApiKey,
+  rateLimitByApiKey,
 
   validateEnhanceRequest,
   logEnhanceRequest,

apps/api-service/src/routes/textToImage.ts

@@ -10,6 +10,8 @@ import {
   logEnhancementResult,
 } from "../middleware/promptEnhancement";
 import { asyncHandler } from "../middleware/errorHandler";
+import { validateApiKey } from "../middleware/auth/validateApiKey";
+import { rateLimitByApiKey } from "../middleware/auth/rateLimiter";
 import { GenerateImageResponse } from "../types/api";
 
 export const textToImageRouter: RouterType = Router();
@@ -21,6 +23,10 @@ let imageGenService: ImageGenService;
  */
 textToImageRouter.post(
   "/text-to-image",
+  // Authentication middleware
+  validateApiKey,
+  rateLimitByApiKey,
+
   // JSON validation middleware
   logTextToImageRequest,
   validateTextToImageRequest,

apps/landing/.gitignore

@@ -0,0 +1,41 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env files (can opt-in for committing if needed)
+.env*
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts

apps/landing/README.md

@@ -1,31 +1,36 @@
-# Banatie Landing Page
+This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).
 
-Next.js landing page for the Banatie AI image generation service.
+## Getting Started
 
-## Features
-
-- Landing page with service overview
-- Demo page for image generation (TODO)
-- Responsive design with Tailwind CSS
-- Integration with Banatie API service
-
-## Development
+First, run the development server:
 
 ```bash
-# Install dependencies
-pnpm install
-
-# Start development server
+npm run dev
+# or
+yarn dev
+# or
 pnpm dev
-
-# Build for production
-pnpm build
+# or
+bun dev
 ```
 
-## TODO
+Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
 
-- [ ] Implement image generation demo
-- [ ] Add API integration with ../api-service
-- [ ] Design landing page content
-- [ ] Add pricing section
-- [ ] Add contact form
+You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.
+
+This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.
+
+## Learn More
+
+To learn more about Next.js, take a look at the following resources:
+
+- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
+- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+
+You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!
+
+## Deploy on Vercel
+
+The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.
+
+Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.

apps/landing/next.config.js

@@ -1,11 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {
-  experimental: {
-    appDir: true,
-  },
-  images: {
-    domains: ['localhost'],
-  },
-}
-
-module.exports = nextConfig

apps/landing/next.config.ts

@@ -0,0 +1,7 @@
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  /* config options here */
+};
+
+export default nextConfig;

apps/landing/package.json

@@ -1,33 +1,23 @@
 {
-  "name": "@banatie/landing",
-  "version": "1.0.0",
-  "description": "Banatie Landing Page - Next.js landing page with image generation demo",
+  "name": "landing",
+  "version": "0.1.0",
   "private": true,
   "scripts": {
-    "dev": "next dev -p 3001",
+    "dev": "next dev -p 3010",
     "build": "next build",
-    "start": "next start -p 3001",
-    "lint": "next lint",
-    "typecheck": "tsc --noEmit"
+    "start": "next start"
   },
   "dependencies": {
-    "next": "^14.2.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
-    "@types/node": "^20.0.0",
-    "@types/react": "^18.2.0",
-    "@types/react-dom": "^18.2.0",
-    "typescript": "^5.9.2"
+    "react": "19.1.0",
+    "react-dom": "19.1.0",
+    "next": "15.5.4"
   },
   "devDependencies": {
-    "tailwindcss": "^3.4.0",
-    "autoprefixer": "^10.4.0",
-    "postcss": "^8.4.0",
-    "eslint": "^8.57.0",
-    "eslint-config-next": "^14.2.0"
-  },
-  "engines": {
-    "node": ">=18.0.0",
-    "pnpm": ">=8.0.0"
+    "typescript": "^5",
+    "@types/node": "^20",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@tailwindcss/postcss": "^4",
+    "tailwindcss": "^4"
   }
 }

apps/landing/postcss.config.mjs

@@ -0,0 +1,5 @@
+const config = {
+  plugins: ["@tailwindcss/postcss"],
+};
+
+export default config;

apps/landing/public/file.svg

@@ -0,0 +1 @@
+<svg fill="none" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M14.5 13.5V5.41a1 1 0 0 0-.3-.7L9.8.29A1 1 0 0 0 9.08 0H1.5v13.5A2.5 2.5 0 0 0 4 16h8a2.5 2.5 0 0 0 2.5-2.5m-1.5 0v-7H8v-5H3v12a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1M9.5 5V2.12L12.38 5zM5.13 5h-.62v1.25h2.12V5zm-.62 3h7.12v1.25H4.5zm.62 3h-.62v1.25h7.12V11z" clip-rule="evenodd" fill="#666" fill-rule="evenodd"/></svg>

apps/landing/public/globe.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g clip-path="url(#a)"><path fill-rule="evenodd" clip-rule="evenodd" d="M10.27 14.1a6.5 6.5 0 0 0 3.67-3.45q-1.24.21-2.7.34-.31 1.83-.97 3.1M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16m.48-1.52a7 7 0 0 1-.96 0H7.5a4 4 0 0 1-.84-1.32q-.38-.89-.63-2.08a40 40 0 0 0 3.92 0q-.25 1.2-.63 2.08a4 4 0 0 1-.84 1.31zm2.94-4.76q1.66-.15 2.95-.43a7 7 0 0 0 0-2.58q-1.3-.27-2.95-.43a18 18 0 0 1 0 3.44m-1.27-3.54a17 17 0 0 1 0 3.64 39 39 0 0 1-4.3 0 17 17 0 0 1 0-3.64 39 39 0 0 1 4.3 0m1.1-1.17q1.45.13 2.69.34a6.5 6.5 0 0 0-3.67-3.44q.65 1.26.98 3.1M8.48 1.5l.01.02q.41.37.84 1.31.38.89.63 2.08a40 40 0 0 0-3.92 0q.25-1.2.63-2.08a4 4 0 0 1 .85-1.32 7 7 0 0 1 .96 0m-2.75.4a6.5 6.5 0 0 0-3.67 3.44 29 29 0 0 1 2.7-.34q.31-1.83.97-3.1M4.58 6.28q-1.66.16-2.95.43a7 7 0 0 0 0 2.58q1.3.27 2.95.43a18 18 0 0 1 0-3.44m.17 4.71q-1.45-.12-2.69-.34a6.5 6.5 0 0 0 3.67 3.44q-.65-1.27-.98-3.1" fill="#666"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h16v16H0z"/></clipPath></defs></svg>

apps/landing/public/next.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>

apps/landing/public/vercel.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1155 1000"><path d="m577.3 0 577.4 1000H0z" fill="#fff"/></svg>

apps/landing/public/window.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.5 2.5h13v10a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1zM0 1h16v11.5a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5zm3.75 4.5a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5M7 4.75a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0m1.75.75a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5" fill="#666"/></svg>

apps/landing/src/app/globals.css

@@ -0,0 +1,58 @@
+@import "tailwindcss";
+
+:root {
+  --background: #0f172a;
+  --foreground: #f8fafc;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+}
+
+/* Custom animations */
+@keyframes gradient-shift {
+  0%, 100% {
+    background-position: 0% 50%;
+  }
+  50% {
+    background-position: 100% 50%;
+  }
+}
+
+@keyframes fade-in {
+  from {
+    opacity: 0;
+    transform: translateY(10px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+
+.animate-gradient {
+  background-size: 200% 200%;
+  animation: gradient-shift 3s ease infinite;
+}
+
+.animate-fade-in {
+  animation: fade-in 0.5s ease-out forwards;
+}
+
+.delay-700 {
+  animation-delay: 700ms;
+}
+
+/* Smooth scrolling */
+html {
+  scroll-behavior: smooth;
+}

apps/landing/src/app/layout.tsx

@@ -1,22 +1,65 @@
-import type { Metadata } from 'next'
+import type { Metadata } from "next";
+import { Inter } from "next/font/google";
+import "./globals.css";
+
+const inter = Inter({
+  variable: "--font-inter",
+  subsets: ["latin"],
+  display: "swap",
+});
 
 export const metadata: Metadata = {
-  title: 'Banatie - AI Image Generation',
-  description: 'Generate stunning images with AI using the Banatie service',
-}
+  title: "Banatie - AI Image Generation API | Developer-First Platform",
+  description: "Transform text and reference images into production-ready visuals with Banatie's developer-first AI image generation API. Powered by Google Gemini & Imagen 4.0. Join the beta.",
+  keywords: ["AI image generation", "image generation API", "text to image", "Gemini API", "developer tools", "REST API", "image AI"],
+  authors: [{ name: "Banatie Team" }],
+  creator: "Banatie",
+  publisher: "Banatie",
+  metadataBase: new URL("https://banatie.com"),
+  openGraph: {
+    type: "website",
+    locale: "en_US",
+    url: "https://banatie.com",
+    title: "Banatie - AI Image Generation API for Developers",
+    description: "Developer-first API for AI-powered image generation. Transform text and reference images into production-ready visuals in seconds.",
+    siteName: "Banatie",
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: "Banatie - AI Image Generation API",
+    description: "Developer-first API for AI-powered image generation. Join the beta.",
+    creator: "@banatie",
+  },
+  robots: {
+    index: true,
+    follow: true,
+    googleBot: {
+      index: true,
+      follow: true,
+      "max-video-preview": -1,
+      "max-image-preview": "large",
+      "max-snippet": -1,
+    },
+  },
+  verification: {
+    google: "google-site-verification-code",
+  },
+};
 
 export default function RootLayout({
   children,
-}: {
-  children: React.ReactNode
-}) {
+}: Readonly<{
+  children: React.ReactNode;
+}>) {
   return (
-    <html lang="en">
-      <body className="min-h-screen bg-gray-50">
-        <div className="container mx-auto px-4">
+    <html lang="en" className="scroll-smooth">
+      <head>
+        <link rel="preconnect" href="https://fonts.googleapis.com" />
+        <link rel="preconnect" href="https://fonts.gstatic.com" crossOrigin="anonymous" />
+      </head>
+      <body className={`${inter.variable} antialiased`}>
         {children}
-        </div>
       </body>
     </html>
-  )
+  );
 }

apps/landing/src/app/page.tsx

@@ -1,28 +1,278 @@
-export default function HomePage() {
+'use client';
+
+import { useState, FormEvent } from 'react';
+import Image from 'next/image';
+
+export default function Home() {
+  const [email, setEmail] = useState('');
+  const [status, setStatus] = useState<'idle' | 'loading' | 'success' | 'error'>('idle');
+  const [message, setMessage] = useState('');
+
+  const handleSubmit = async (e: FormEvent) => {
+    e.preventDefault();
+    setStatus('loading');
+
+    // TODO: Replace with actual API endpoint
+    setTimeout(() => {
+      setStatus('success');
+      setMessage('You\'re on the list! Check your email for beta access details.');
+      setEmail('');
+    }, 1000);
+  };
+
   return (
-    <div className="py-12">
-      <div className="text-center">
-        <h1 className="text-4xl font-bold text-gray-900 mb-4">
-          Welcome to Banatie
-        </h1>
-        <p className="text-xl text-gray-600 mb-8">
-          AI-Powered Image Generation Service
-        </p>
-        <div className="bg-white rounded-lg shadow-md p-8 max-w-2xl mx-auto">
-          <h2 className="text-2xl font-semibold mb-4">Demo Coming Soon</h2>
-          <p className="text-gray-600">
-            Experience the power of AI image generation with our Gemini Flash model integration.
-          </p>
-          <div className="mt-6">
-            <button
-              className="bg-blue-600 text-white px-6 py-3 rounded-lg font-medium hover:bg-blue-700 disabled:opacity-50"
-              disabled
+    <div className="min-h-screen bg-gradient-to-br from-slate-950 via-purple-950 to-slate-950">
+      {/* Animated gradient background */}
+      <div className="fixed inset-0 overflow-hidden pointer-events-none">
+        <div className="absolute top-1/4 -left-1/4 w-96 h-96 bg-purple-600/30 rounded-full blur-3xl animate-pulse"></div>
+        <div className="absolute bottom-1/4 -right-1/4 w-96 h-96 bg-cyan-600/30 rounded-full blur-3xl animate-pulse delay-700"></div>
+      </div>
+
+      {/* Header */}
+      <header className="relative z-10 border-b border-white/10 backdrop-blur-sm">
+        <nav className="max-w-7xl mx-auto px-6 py-3 flex justify-between items-center h-16">
+          <div className="h-full flex items-center">
+            <Image
+              src="/banatie-logo-horisontal.png"
+              alt="Banatie Logo"
+              width={150}
+              height={40}
+              priority
+              className="h-full w-auto object-contain"
+            />
+          </div>
+          <a
+            href="#waitlist"
+            className="text-sm text-gray-300 hover:text-white transition-colors"
           >
-              Try Demo (Coming Soon)
+            Join Beta
+          </a>
+        </nav>
+      </header>
+
+      {/* Hero Section */}
+      <section className="relative z-10 max-w-7xl mx-auto px-6 pt-20 pb-16 md:pt-32 md:pb-24">
+        <div className="text-center max-w-4xl mx-auto">
+          <div className="inline-block mb-4 px-4 py-1.5 rounded-full bg-purple-500/10 border border-purple-500/20 text-purple-300 text-sm font-medium">
+            Now in Closed Beta
+          </div>
+
+          <h1 className="text-5xl md:text-7xl font-bold tracking-tight mb-6 flex flex-col items-center gap-4">
+            <span className="bg-gradient-to-r from-white to-gray-300 bg-clip-text text-transparent whitespace-nowrap">
+              Your AI Image Generation API
+            </span>
+            <span className="bg-gradient-to-r from-purple-400 via-cyan-400 to-purple-400 bg-clip-text text-transparent animate-gradient whitespace-nowrap">
+              Ready in 60 seconds
+            </span>
+          </h1>
+
+          <p className="text-xl md:text-2xl text-gray-400 mb-8 leading-relaxed">
+            Developer-first API for AI-powered image generation.
+            <br className="hidden md:block" />
+            Transform text and reference images into production-ready visuals.
+          </p>
+
+          {/* Email Capture Form */}
+          <div id="waitlist" className="max-w-md mx-auto mb-12">
+            <form onSubmit={handleSubmit} className="flex flex-col sm:flex-row gap-3">
+              <input
+                type="email"
+                value={email}
+                onChange={(e) => setEmail(e.target.value)}
+                placeholder="your@email.com"
+                required
+                disabled={status === 'loading' || status === 'success'}
+                className="flex-1 px-6 py-4 rounded-xl bg-white/5 border border-white/10 text-white placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-purple-500 focus:border-transparent backdrop-blur-sm disabled:opacity-50"
+              />
+              <button
+                type="submit"
+                disabled={status === 'loading' || status === 'success'}
+                className="px-8 py-4 rounded-xl bg-gradient-to-r from-purple-600 to-cyan-600 text-white font-semibold hover:from-purple-500 hover:to-cyan-500 transition-all disabled:opacity-50 disabled:cursor-not-allowed shadow-lg shadow-purple-500/25"
+              >
+                {status === 'loading' ? 'Joining...' : status === 'success' ? 'Joined!' : 'Join Beta'}
               </button>
+            </form>
+            {status === 'success' && (
+              <p className="mt-3 text-sm text-green-400 animate-fade-in">{message}</p>
+            )}
+          </div>
+
+          {/* Quick Feature Pills */}
+          <div className="flex flex-wrap justify-center gap-3 text-sm text-gray-400">
+            <span className="px-4 py-2 rounded-full bg-white/5 border border-white/10">
+              ⚡ RESTful API
+            </span>
+            <span className="px-4 py-2 rounded-full bg-white/5 border border-white/10">
+              🎨 Reference Images
+            </span>
+            <span className="px-4 py-2 rounded-full bg-white/5 border border-white/10">
+              🧠 Auto Prompt Enhancement
+            </span>
+            <span className="px-4 py-2 rounded-full bg-white/5 border border-white/10">
+              🔐 Enterprise Security
+            </span>
           </div>
         </div>
+      </section>
+
+      {/* Code Example Section */}
+      <section className="relative z-10 max-w-7xl mx-auto px-6 py-16">
+        <div className="max-w-3xl mx-auto">
+          <div className="bg-slate-900/50 backdrop-blur-sm border border-white/10 rounded-2xl p-8 shadow-2xl">
+            <div className="flex items-center gap-2 mb-4">
+              <div className="flex gap-1.5">
+                <div className="w-3 h-3 rounded-full bg-red-500/50"></div>
+                <div className="w-3 h-3 rounded-full bg-yellow-500/50"></div>
+                <div className="w-3 h-3 rounded-full bg-green-500/50"></div>
+              </div>
+              <span className="text-sm text-gray-500 ml-2">Quick Start</span>
+            </div>
+            <pre className="text-sm md:text-base text-gray-300 overflow-x-auto">
+              <code>{`curl -X POST https://api.banatie.com/generate \\
+  -H "X-API-Key: YOUR_KEY" \\
+  -F "prompt=futuristic city at sunset" \\
+  -F "filename=city"
+
+# ✅ Response in ~3 seconds
+{
+  "success": true,
+  "url": "https://cdn.banatie.com/city.png"
+}`}</code>
+            </pre>
           </div>
         </div>
-  )
+      </section>
+
+      {/* Features Grid */}
+      <section className="relative z-10 max-w-7xl mx-auto px-6 py-16 md:py-24">
+        <h2 className="text-3xl md:text-4xl font-bold text-center mb-16 text-white">
+          Built for Developers, Powered by AI
+        </h2>
+
+        <div className="grid md:grid-cols-3 gap-8">
+          {/* Feature 1 */}
+          <div className="p-8 rounded-2xl bg-gradient-to-br from-purple-500/10 to-transparent border border-purple-500/20 backdrop-blur-sm hover:border-purple-500/40 transition-colors">
+            <div className="w-12 h-12 rounded-xl bg-purple-500/20 flex items-center justify-center mb-4 text-2xl">
+              🚀
+            </div>
+            <h3 className="text-xl font-semibold text-white mb-3">
+              Instant Integration
+            </h3>
+            <p className="text-gray-400 leading-relaxed">
+              Clean REST API that works with any stack. From hobbyist to enterprise, start generating images in minutes.
+            </p>
+          </div>
+
+          {/* Feature 2 */}
+          <div className="p-8 rounded-2xl bg-gradient-to-br from-cyan-500/10 to-transparent border border-cyan-500/20 backdrop-blur-sm hover:border-cyan-500/40 transition-colors">
+            <div className="w-12 h-12 rounded-xl bg-cyan-500/20 flex items-center justify-center mb-4 text-2xl">
+              🎯
+            </div>
+            <h3 className="text-xl font-semibold text-white mb-3">
+              Reference-Guided Generation
+            </h3>
+            <p className="text-gray-400 leading-relaxed">
+              Upload up to 3 reference images alongside your prompt. Perfect for brand consistency and style matching.
+            </p>
+          </div>
+
+          {/* Feature 3 */}
+          <div className="p-8 rounded-2xl bg-gradient-to-br from-purple-500/10 to-transparent border border-purple-500/20 backdrop-blur-sm hover:border-purple-500/40 transition-colors">
+            <div className="w-12 h-12 rounded-xl bg-purple-500/20 flex items-center justify-center mb-4 text-2xl">
+              ✨
+            </div>
+            <h3 className="text-xl font-semibold text-white mb-3">
+              Smart Prompt Enhancement
+            </h3>
+            <p className="text-gray-400 leading-relaxed">
+              AI-powered prompt optimization with language detection. Get better results automatically.
+            </p>
+          </div>
+
+          {/* Feature 4 */}
+          <div className="p-8 rounded-2xl bg-gradient-to-br from-cyan-500/10 to-transparent border border-cyan-500/20 backdrop-blur-sm hover:border-cyan-500/40 transition-colors">
+            <div className="w-12 h-12 rounded-xl bg-cyan-500/20 flex items-center justify-center mb-4 text-2xl">
+              🔐
+            </div>
+            <h3 className="text-xl font-semibold text-white mb-3">
+              Enterprise-Ready Security
+            </h3>
+            <p className="text-gray-400 leading-relaxed">
+              API key management, rate limiting, multi-tenant architecture. Built for production from day one.
+            </p>
+          </div>
+
+          {/* Feature 5 */}
+          <div className="p-8 rounded-2xl bg-gradient-to-br from-purple-500/10 to-transparent border border-purple-500/20 backdrop-blur-sm hover:border-purple-500/40 transition-colors">
+            <div className="w-12 h-12 rounded-xl bg-purple-500/20 flex items-center justify-center mb-4 text-2xl">
+              ⚡
+            </div>
+            <h3 className="text-xl font-semibold text-white mb-3">
+              Dual AI Models
+            </h3>
+            <p className="text-gray-400 leading-relaxed">
+              Powered by Google Gemini 2.5 Flash and Imagen 4.0. Automatic fallback ensures reliability.
+            </p>
+          </div>
+
+          {/* Feature 6 */}
+          <div className="p-8 rounded-2xl bg-gradient-to-br from-cyan-500/10 to-transparent border border-cyan-500/20 backdrop-blur-sm hover:border-cyan-500/40 transition-colors">
+            <div className="w-12 h-12 rounded-xl bg-cyan-500/20 flex items-center justify-center mb-4 text-2xl">
+              📦
+            </div>
+            <h3 className="text-xl font-semibold text-white mb-3">
+              Organized Cloud Storage
+            </h3>
+            <p className="text-gray-400 leading-relaxed">
+              Automatic file organization by org/project/category. CDN-ready URLs for instant delivery.
+            </p>
+          </div>
+        </div>
+      </section>
+
+      {/* CTA Section */}
+      <section className="relative z-10 max-w-4xl mx-auto px-6 py-16 md:py-24">
+        <div className="text-center p-12 rounded-3xl bg-gradient-to-br from-purple-600/20 via-cyan-600/20 to-purple-600/20 border border-purple-500/30 backdrop-blur-sm">
+          <h2 className="text-3xl md:text-4xl font-bold text-white mb-4">
+            Join the Beta Program
+          </h2>
+          <p className="text-xl text-gray-300 mb-8">
+            Get early access, shape the product, and lock in founder pricing.
+          </p>
+          <a
+            href="#waitlist"
+            className="inline-block px-8 py-4 rounded-xl bg-white text-purple-950 font-semibold hover:bg-gray-100 transition-colors shadow-lg"
+          >
+            Request Beta Access
+          </a>
+        </div>
+      </section>
+
+      {/* Footer */}
+      <footer className="relative z-10 border-t border-white/10 backdrop-blur-sm">
+        <div className="max-w-7xl mx-auto px-6 pt-12 pb-4">
+          <div className="flex flex-col md:flex-row justify-between items-center gap-6">
+            <div className="h-16 flex items-center">
+              <Image
+                src="/banatie-logo-horisontal.png"
+                alt="Banatie Logo"
+                width={200}
+                height={60}
+                className="h-full w-auto object-contain"
+              />
+            </div>
+            <div className="flex gap-8 text-sm text-gray-400">
+              <a href="#" className="hover:text-white transition-colors">Documentation</a>
+              <a href="#" className="hover:text-white transition-colors">API Reference</a>
+              <a href="#" className="hover:text-white transition-colors">Pricing</a>
+              <a href="#" className="hover:text-white transition-colors">Contact</a>
+            </div>
+          </div>
+          <div className="mt-8 text-center text-sm text-gray-500">
+            &copy; 2025 Banatie. Built for builders who create.
+          </div>
+        </div>
+      </footer>
+    </div>
+  );
 }

apps/landing/tsconfig.json

@@ -1,7 +1,7 @@
 {
   "compilerOptions": {
-    "target": "ES2022",
-    "lib": ["dom", "dom.iterable", "ES2022"],
+    "target": "ES2017",
+    "lib": ["dom", "dom.iterable", "esnext"],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -18,7 +18,6 @@
         "name": "next"
       }
     ],
-    "baseUrl": ".",
     "paths": {
       "@/*": ["./src/*"]
     }

docs/api/README.md

@@ -10,7 +10,40 @@ http://localhost:3000
 
 ## Authentication
 
-API key required via `GEMINI_API_KEY` environment variable (server-side configuration).
+All API endpoints (except `/health`, `/api/info`, and `/api/bootstrap/*`) require authentication via API key.
+
+### API Key Types
+
+1. **Master Keys** - Full admin access, never expire, can create/revoke other keys
+2. **Project Keys** - Standard access for image generation, expire in 90 days
+
+### Using API Keys
+
+Include your API key in the `X-API-Key` header:
+
+```bash
+curl -X POST http://localhost:3000/api/generate \
+  -H "X-API-Key: bnt_your_key_here" \
+  -F "prompt=..." \
+  -F "filename=..."
+```
+
+### Getting Your First API Key
+
+1. **Bootstrap** - Create initial master key (one-time only):
+   ```bash
+   curl -X POST http://localhost:3000/api/bootstrap/initial-key
+   ```
+
+2. **Create Project Key** - Use master key to create project keys:
+   ```bash
+   curl -X POST http://localhost:3000/api/admin/keys \
+     -H "X-API-Key: YOUR_MASTER_KEY" \
+     -H "Content-Type: application/json" \
+     -d '{"type": "project", "projectId": "my-project", "name": "My Project Key"}'
+   ```
+
+**Important:** Save keys securely when created - they cannot be retrieved later!
 
 ## Content Types
 
@@ -19,12 +52,156 @@ API key required via `GEMINI_API_KEY` environment variable (server-side configur
 
 ## Rate Limits
 
-Standard Express rate limiting applies. Configure via environment variables.
+All authenticated endpoints (those requiring API keys) are rate limited:
+
+- **Per API Key:** 100 requests per hour
+- **Applies to:**
+  - `POST /api/generate`
+  - `POST /api/text-to-image`
+  - `POST /api/enhance`
+- **Not rate limited:**
+  - Public endpoints (`GET /health`, `GET /api/info`)
+  - Bootstrap endpoint (`POST /api/bootstrap/initial-key`)
+  - Admin endpoints (require master key, but no rate limit)
+  - Image serving endpoints (`GET /api/images/*`)
+
+Rate limit information included in response headers:
+- `X-RateLimit-Limit`: Maximum requests per window
+- `X-RateLimit-Remaining`: Requests remaining
+- `X-RateLimit-Reset`: When the limit resets (ISO 8601)
+
+**429 Too Many Requests:** Returned when limit exceeded with `Retry-After` header
 
 ---
 
 ## Endpoints
 
+### Overview
+
+| Endpoint | Method | Authentication | Rate Limit | Description |
+|----------|--------|----------------|------------|-------------|
+| `/health` | GET | None | No | Health check |
+| `/api/info` | GET | None | No | API information |
+| `/api/bootstrap/initial-key` | POST | None (one-time) | No | Create first master key |
+| `/api/admin/keys` | POST | Master Key | No | Create new API keys |
+| `/api/admin/keys` | GET | Master Key | No | List all API keys |
+| `/api/admin/keys/:keyId` | DELETE | Master Key | No | Revoke API key |
+| `/api/generate` | POST | API Key | 100/hour | Generate images with files |
+| `/api/text-to-image` | POST | API Key | 100/hour | Generate images (JSON only) |
+| `/api/enhance` | POST | API Key | 100/hour | Enhance text prompts |
+| `/api/images/*` | GET | None | No | Serve generated images |
+
+---
+
+### Authentication & Admin
+
+#### `POST /api/bootstrap/initial-key`
+
+Create the first master API key. This endpoint works only once when no keys exist.
+
+**Authentication:** None required (public endpoint, one-time use)
+
+**Response (201):**
+```json
+{
+  "apiKey": "bnt_...",
+  "type": "master",
+  "name": "Initial Master Key",
+  "expiresAt": null,
+  "message": "IMPORTANT: Save this key securely. You will not see it again!"
+}
+```
+
+**Error (403):**
+```json
+{
+  "error": "Bootstrap not allowed",
+  "message": "API keys already exist. Use /api/admin/keys to create new keys."
+}
+```
+
+---
+
+#### `POST /api/admin/keys`
+
+Create a new API key (master or project).
+
+**Authentication:** Master key required via `X-API-Key` header
+
+**Request Body:**
+```json
+{
+  "type": "master | project",
+  "projectId": "required-for-project-keys",
+  "name": "optional-friendly-name",
+  "expiresInDays": 90
+}
+```
+
+**Response (201):**
+```json
+{
+  "apiKey": "bnt_...",
+  "metadata": {
+    "id": "uuid",
+    "type": "project",
+    "projectId": "my-project",
+    "name": "My Project Key",
+    "expiresAt": "2025-12-29T17:08:02.536Z",
+    "scopes": ["generate", "read"],
+    "createdAt": "2025-09-30T17:08:02.553Z"
+  },
+  "message": "IMPORTANT: Save this key securely. You will not see it again!"
+}
+```
+
+---
+
+#### `GET /api/admin/keys`
+
+List all API keys.
+
+**Authentication:** Master key required
+
+**Response (200):**
+```json
+{
+  "keys": [
+    {
+      "id": "uuid",
+      "type": "master",
+      "projectId": null,
+      "name": "Initial Master Key",
+      "scopes": ["*"],
+      "isActive": true,
+      "createdAt": "2025-09-30T17:01:23.456Z",
+      "expiresAt": null,
+      "lastUsedAt": "2025-09-30T17:08:45.123Z",
+      "createdBy": null
+    }
+  ],
+  "total": 1
+}
+```
+
+---
+
+#### `DELETE /api/admin/keys/:keyId`
+
+Revoke an API key (soft delete).
+
+**Authentication:** Master key required
+
+**Response (200):**
+```json
+{
+  "message": "API key revoked successfully",
+  "keyId": "uuid"
+}
+```
+
+---
+
 ### Health Check
 
 #### `GET /health`
@@ -79,6 +256,9 @@ Returns API metadata and configuration limits.
 
 Generate images from text prompts with optional reference images.
 
+**Authentication:** API key required (master or project)
+**Rate Limit:** 100 requests per hour per API key
+
 **Content-Type:** `multipart/form-data`
 
 **Parameters:**
@@ -105,6 +285,7 @@ Generate images from text prompts with optional reference images.
 **Example Request:**
 ```bash
 curl -X POST http://localhost:3000/api/generate \
+  -H "X-API-Key: bnt_your_api_key_here" \
   -F "prompt=A majestic mountain landscape at sunset" \
   -F "filename=mountain-sunset" \
   -F "autoEnhance=true" \
@@ -151,6 +332,9 @@ curl -X POST http://localhost:3000/api/generate \
 
 Generate images from text prompts only using JSON payload. Simplified endpoint for text-only requests without file uploads.
 
+**Authentication:** API key required (master or project)
+**Rate Limit:** 100 requests per hour per API key
+
 **Content-Type:** `application/json`
 
 **Request Body:**
@@ -180,6 +364,7 @@ Generate images from text prompts only using JSON payload. Simplified endpoint f
 **Example Request:**
 ```bash
 curl -X POST http://localhost:3000/api/text-to-image \
+  -H "X-API-Key: bnt_your_api_key_here" \
   -H "Content-Type: application/json" \
   -d '{
     "prompt": "A beautiful sunset over mountains with golden clouds",
@@ -237,6 +422,9 @@ curl -X POST http://localhost:3000/api/text-to-image \
 
 Enhance and optimize text prompts for better image generation results.
 
+**Authentication:** API key required (master or project)
+**Rate Limit:** 100 requests per hour per API key
+
 **Content-Type:** `application/json`
 
 **Request Body:**
@@ -299,17 +487,40 @@ Enhance and optimize text prompts for better image generation results.
 | Code | Description |
 |------|-------------|
 | 400 | Bad Request - Invalid parameters or validation failure |
-| 404 | Not Found - Endpoint does not exist |
+| 401 | Unauthorized - Missing, invalid, expired, or revoked API key |
+| 403 | Forbidden - Insufficient permissions (e.g., master key required) |
+| 404 | Not Found - Endpoint or resource does not exist |
+| 429 | Too Many Requests - Rate limit exceeded |
 | 500 | Internal Server Error - Server configuration or processing error |
 
 ## Common Error Messages
 
+### Authentication Errors (401)
+- `"Missing API key"` - No X-API-Key header provided
+- `"Invalid API key"` - The provided API key is invalid, expired, or revoked
+- **Affected endpoints:** `/api/generate`, `/api/text-to-image`, `/api/enhance`, `/api/admin/*`
+
+### Authorization Errors (403)
+- `"Master key required"` - This endpoint requires a master API key (not project key)
+- `"Bootstrap not allowed"` - API keys already exist, cannot bootstrap again
+- **Affected endpoints:** `/api/admin/*`, `/api/bootstrap/initial-key`
+
+### Validation Errors (400)
 - `"Prompt is required"` - Missing or empty prompt parameter
 - `"Reference image validation failed"` - Invalid file format or size
-- `"Server configuration error"` - Missing GEMINI_API_KEY
-- `"Image generation failed"` - AI service error
 - `"Validation failed"` - Parameter validation error
 
+### Rate Limiting Errors (429)
+- `"Rate limit exceeded"` - Too many requests, retry after specified time
+- **Applies to:** `/api/generate`, `/api/text-to-image`, `/api/enhance`
+- **Rate limit:** 100 requests per hour per API key
+- **Response includes:** `Retry-After` header with seconds until reset
+
+### Server Errors
+- `"Server configuration error"` - Missing GEMINI_API_KEY or database connection
+- `"Image generation failed"` - AI service error
+- `"Authentication failed"` - Error during authentication process
+
 ---
 
 ## File Upload Specifications
@@ -323,8 +534,23 @@ Enhance and optimize text prompts for better image generation results.
 
 | Header | Value | Description |
 |--------|-------|-------------|
-| `X-Request-ID` | string | Unique request identifier (auto-generated) |
+| `X-API-Key` | string | API key for authentication (required for most endpoints) |
+| `X-Request-ID` | string | Unique request identifier (auto-generated by server) |
+
+## Response Headers
+
+| Header | Description |
+|--------|-------------|
+| `X-Request-ID` | Request identifier for tracking |
+| `X-RateLimit-Limit` | Maximum requests allowed per window |
+| `X-RateLimit-Remaining` | Requests remaining in current window |
+| `X-RateLimit-Reset` | When the rate limit resets (ISO 8601) |
 
 ## CORS
 
-Cross-origin requests supported. Configure via `CORS_ORIGIN` environment variable.
+Cross-origin requests supported from:
+- `http://localhost:3001` (Landing Page)
+- `http://localhost:3002` (Studio Platform)
+- `http://localhost:3003` (Admin Dashboard)
+
+Configure additional origins via `CORS_ORIGIN` environment variable.

docs/api/api.rest

@@ -1,4 +1,8 @@
 @base = http://localhost:3000
+# Replace with your actual API key (e.g., bnt_abc123...)
+@apiKey = bnt_d0da2d441cd2f22a0ec13897629b4438cc723f0bcb320d646a41ed05a985fdf8
+# Replace with your master key for admin endpoints
+@masterKey = bnt_71475a11d69344ff9db2236ff4f10cfca34512b29c7ac1a74f73c156d708e226
 
 
 ### Health
@@ -11,10 +15,42 @@ GET {{base}}/health
 GET {{base}}/api/info
 
 
-### enhance
+### Bootstrap - Create First Master Key (One-time only)
+
+POST {{base}}/api/bootstrap/initial-key
+
+
+### Admin - Create New API Key (Requires Master Key)
+
+POST {{base}}/api/admin/keys
+Content-Type: application/json
+X-API-Key: {{masterKey}}
+
+{
+  "type": "project",
+  "projectId": "my-project",
+  "name": "My Project Key",
+  "expiresInDays": 90
+}
+
+
+### Admin - List All API Keys (Requires Master Key)
+
+GET {{base}}/api/admin/keys
+X-API-Key: {{masterKey}}
+
+
+### Admin - Revoke API Key (Requires Master Key)
+
+DELETE {{base}}/api/admin/keys/KEY_ID_HERE
+X-API-Key: {{masterKey}}
+
+
+### Enhance Prompt (Requires API Key)
 
 POST {{base}}/api/enhance
 Content-Type: application/json
+X-API-Key: {{apiKey}}
 
 {
   "prompt": "Два мага сражаются в снежном лесу. У одного из них в руках посох, из которого вырывается молния, а другой маг защищается щитом из льда. Вокруг них падают снежинки, и на заднем плане видны заснеженные деревья и горы.",
@@ -30,10 +66,11 @@ Content-Type: application/json
 }
 
 
-### Generate image from text
+### Generate Image from Text (Requires API Key)
 
 POST {{base}}/api/text-to-image
 Content-Type: application/json
+X-API-Key: {{apiKey}}
 
 {
   "prompt": "A majestic eagle soaring over snow-capped mountains",
@@ -41,9 +78,11 @@ Content-Type: application/json
 }
 
 
-### Generate Image with Files
+### Generate Image with Files (Requires API Key)
+
 POST {{base}}/api/generate
 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
+X-API-Key: {{apiKey}}
 
 ------WebKitFormBoundary
 Content-Disposition: form-data; name="prompt"