docs(server): clarify metrics authentication behavior

This commit is contained in:
2026-04-11 21:50:26 +02:00
parent c7a3fed6e1
commit 045c3d9d6f
2 changed files with 6 additions and 5 deletions

View File

@@ -334,7 +334,7 @@ Enable in config: `metrics.enabled: true`. Scrape at `GET /metrics`. Human-reada
`GET /dashboard` renders a live HTML view of all metrics. Counters show request counts with status-code badges, histograms show p50/p95/p99 latencies, gauges show current endpoint priority and inflight counts.
Auth follows the same rules as `/metrics`: server `api_keys` apply, and `metrics.api_key` adds a second layer if set.
Auth: if `metrics.api_key` is set, both `/metrics` and `/dashboard` require that key (Bearer token) and ignore server-level `api_keys`. If `metrics.api_key` is blank, both routes are fully public — no auth headers are checked.
---