Two doors: payment for buyers, keys for operators
A public ASP is two products in one process: a marketplace surface anyone can probe, and an operator surface that must stay private. Confusing those doors is how free generation and database spam show up.
When Metiora first came online, the temptation was the same temptation every shipping team feels: leave routes open so testing stays easy. On a private laptop that is harmless. On a domain with a real TLS certificate it is an invitation. The internet will find your write endpoints. It always does.
Door one: the marketplace
Buyers need a public path. They need health checks, an avatar, a services catalog, bootstrap, and paid product endpoints. For those routes, payment is the ticket. The Metiora operator API key is not part of the buyer journey, and it should not be. An agent purchasing a blueprint should not hold production admin credentials.
Door two: the control plane
Operators need a different ticket. Memory administration, internal helpers, and metrics stay behind a long random API key. Production refuses to boot without one. That is intentional friction. It means a misconfigured deploy fails closed instead of silently becoming a free package factory.
What open write paths actually cost
Open memory creation without limits fills the database with junk. Open package generation without payment destroys the marketplace model. Simulated internal escrow helpers, if exposed, train people to believe fake settlement is real settlement. Clear boundaries prevent those stories from becoming production incidents.
Secrets stay out of the public repo
GitHub is for source and documentation. Real keys live in host secrets and local ignored files. The repository’s gitignore is written to catch the usual accidents: env files, local key dumps, temporary payment payloads. If something still leaks, rotate first and clean history second. A burned key is cheaper than a long debate.
The design rule we keep
If a stranger should be able to do it after paying, put it on the public marketplace surface. If only the operator should do it, put it behind the key. Two doors. Two tickets. One service that can survive being public.