Cache api key validations per isolate

[RhysSullivan]

Every MCP request and every api-key-authenticated /api/* request paid a live WorkOS round trip (~100-150ms) to validate the presented key. The JWT bearer path verifies locally against a JWKS cached for an hour; api keys had no cache.

This adds a bounded per-isolate TTL cache (60s, 10k entries, same shape as the execution-gate balance cache) in front of validateApiKey:

• Keyed by the SHA-256 digest of the key value, never the raw credential. The digest reaches no log, span, or error message.
• Only successful validations are cached. Invalid keys and upstream failures always miss, so probing bad keys cannot pollute the map and a just-created key works immediately.
• Concurrent misses for the same key each call WorkOS (no in-flight dedupe): the duplicate window is one round trip per key per TTL per isolate — the cost every request paid before — and dedupe would add interruption-safety machinery to auth code.

Tradeoff, stated plainly: a revoked key remains usable for up to 60 seconds within an isolate that validated it before revocation. That is far tighter than the 1h JWKS rotation window the JWT path already accepts.

Tested with unit tests covering cache hits, TTL expiry, invalid-key and failure non-caching, the size bound (reset and expired-entry sweep), and digest-only map keys.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	9148ce8	Commit Preview URL Branch Preview URL	Aug 30 2026, 03:14 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	9148ce8	Aug 30 2026, 03:15 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1864

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1864

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1864

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1864

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1864

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1864

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1864

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1864

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1864

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1864

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1864

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1864

executor

npm i https://pkg.pr.new/executor@1864

commit: 9148ce8