Quick start
Services
Configuration
Environment variables
API_KEY_SECRET and QWED_CORS_ORIGINS are mandatory as of v5.0.0. See the deployment guide for the full reference.
API configuration
Docker
API only
Build and run
Kubernetes
🏢 Enterprise Support Coming Soon: Managed hosting, dedicated support, and SLA guarantees. Contact support@qwedai.com
Scaling
Horizontal scaling
- Stateless API servers behind load balancer
- Redis for distributed rate limiting
- PostgreSQL with read replicas
Availability limits
QWED bounds request size, slow work, and sandbox usage so one request can’t stall or exhaust a server process. The defaults suit most deployments. Raise them only if your host has the headroom.
Request body caps are fixed. Every /verify JSON route accepts up to 1,000,000 bytes. /verify/stats and /verify/image accept their 10 MB file limit plus envelope headroom. QWED rejects an oversized body with 413 before processing it. See Request limits for the full error list.
QWED_SANDBOX_MAX_CONCURRENT applies per worker process. With uvicorn --workers 4 and the default of 4, a host can run up to 16 sandbox containers. Size the value against your host’s memory, CPU, and PID limits.
Monitoring
Health check
Prometheus metrics
Scrape GET /metrics/prometheus (the Prometheus text exposition format — /metrics returns JSON). The endpoint requires a platform operator: create a dedicated scraper account, add its user ID to QWED_METRICS_OPERATOR_USER_IDS (fail-closed when unset — every caller is denied, including org owners/admins), mint the account an API key, and send it as a header on the scrape. See All-tenant metrics authorization.
Security
- Always use HTTPS in production
- Set
API_KEY_SECRET — mandatory, no default value
- Set
QWED_CORS_ORIGINS — mandatory, explicitly list allowed origins
- Set strong API keys
- Enable rate limiting
- Use network isolation
- Rotate secrets regularly
- Configure
QWED_METRICS_OPERATOR_USER_IDS if anything needs all-tenant metrics — unset means deny-all