Skip to main content

Quick start

Services

Configuration

Environment variables

API_KEY_SECRET and QWED_CORS_ORIGINS are mandatory as of v5.0.0. See the deployment guide for the full reference.

API configuration

Docker

API only

Build and run

Kubernetes

🏢 Enterprise Support Coming Soon: Managed hosting, dedicated support, and SLA guarantees. Contact support@qwedai.com

Scaling

Horizontal scaling

  • Stateless API servers behind load balancer
  • Redis for distributed rate limiting
  • PostgreSQL with read replicas

Performance tuning

Availability limits

QWED bounds request size, slow work, and sandbox usage so one request can’t stall or exhaust a server process. The defaults suit most deployments. Raise them only if your host has the headroom.
Request body caps are fixed. Every /verify JSON route accepts up to 1,000,000 bytes. /verify/stats and /verify/image accept their 10 MB file limit plus envelope headroom. QWED rejects an oversized body with 413 before processing it. See Request limits for the full error list.
QWED_SANDBOX_MAX_CONCURRENT applies per worker process. With uvicorn --workers 4 and the default of 4, a host can run up to 16 sandbox containers. Size the value against your host’s memory, CPU, and PID limits.

Monitoring

Health check

Prometheus metrics

Scrape GET /metrics/prometheus (the Prometheus text exposition format — /metrics returns JSON). The endpoint requires a platform operator: create a dedicated scraper account, add its user ID to QWED_METRICS_OPERATOR_USER_IDS (fail-closed when unset — every caller is denied, including org owners/admins), mint the account an API key, and send it as a header on the scrape. See All-tenant metrics authorization.

Security

  1. Always use HTTPS in production
  2. Set API_KEY_SECRET — mandatory, no default value
  3. Set QWED_CORS_ORIGINS — mandatory, explicitly list allowed origins
  4. Set strong API keys
  5. Enable rate limiting
  6. Use network isolation
  7. Rotate secrets regularly
  8. Configure QWED_METRICS_OPERATOR_USER_IDS if anything needs all-tenant metrics — unset means deny-all