# Trial: mcode endpoint / key pairing

- **Date:** 2026-10-19
- **Question / hypothesis:** the SecretVault secret `zai_api_key` (plain 48–49 char
  string) is the direct z.ai API key, not the `vault.itsaygea.com` proxy clientKey;
  therefore the statusline should default to `https://api.z.ai`.
- **Scope / acceptance:** three HTTP probes return codes consistent with exactly one
  pairing per key; no key material printed.
- **Inputs / environment:** host `mewtwo` (Ubuntu, PVE), curl with `--max-time 8`,
  key fetched via `secretvault run --secret zai_api_key -- bash -c 'printf %s "$zai_api_key"'`;
  legacy key from `~/.secretvault/credential.json` (`.clientKey`, 51 chars).
- **Procedure:**
  ```bash
  # codes only; -o /dev/null -w '%{http_code}'
  vault-key  @ https://vault.itsaygea.com/proxy/zai/api/monitor/usage/quota/limit
  vault-key  @ https://api.z.ai/api/monitor/usage/quota/limit
  cred-key   @ https://vault.itsaygea.com/proxy/zai/api/monitor/usage/quota/limit
  ```
- **Expected vs observed:** expected one 200; observed
  `401 (vault@proxy) / 200 (vault@zai) / 200 (cred@proxy)`.
- **Verdict:** confirmed — vault key is the direct z.ai credential; proxy clientKey is
  separate. `zai-usage.sh` implements vault→`api.z.ai` first, credential.json→proxy fallback.
- **Repeat guard:** revisit if the vault secret is rotated to a proxy clientKey, or if
  `api.z.ai` starts rejecting it (401 after rotation).