Request lifecycle
How TokenGuard decides before upstream.
Every guarded call runs preflight in parallel: budget reservation and loop detection. Failures never reach the provider. Success strips control headers and settles after the response.
- 1
Resolve provider
From X-TokenGuard-Provider, path heuristics, or TOKENGUARD_DEFAULT_PROVIDER.
- 2
Authenticate key
Require X-TokenGuard-API-Key. Plaintext tg_ only at provision; hashed at rest.
- 3
Analyze body
Model, tiktoken input estimate, session id, semantic payload for the loop breaker.
- 4
Budget + loop in parallel
Reserve micro-USD in Turso. Redis INCR on session + payload hash. Trip at threshold.
- 5
Fail closed or forward
402 budget · 409 loop · 400 unpriced · 503 store down — or strip X-TokenGuard-* and proxy.
- 6
Settle usage
Count output (incl. SSE). Settle actual cost, release unused reservation, log the ledger event.