feat(api): accept Ory access tokens from the CLI's login

[alukach]

Part of #588. The CLI half is source-cooperative/source-coop-cli#23.

The API now takes an Ory access token as a bearer, alongside the assertions the data proxy signs, so the CLI can call /api/v1 as the person who logged in. getApiSession routes a bearer by its unverified iss: Ory's tokens go to the new authenticateWithOryAccessToken, and the proxy's go to the existing verifier. Neither falls back to the other or to the session cookie.

The Ory verifier checks the token against Ory's published JWKS, with the issuer (with or without a trailing slash), RS256, expiry, a 30-second tolerance, and the request's origin as audience. An ID token, which Ory issues to the client ID, never passes, and which clients may mint a token for the API is decided in Ory by the audiences each client is allowed. The subject is looked up only as a person's Ory identity. Both verifiers build the session in one place, sessionForAccount. ORY_OAUTH2_ISSUER names Ory's issuer when it isn't NEXT_PUBLIC_ORY_SDK_URL.

Deploying:

• Before merging, the CLI's Ory clients need the jwt access-token strategy and this site's origin as an allowed audience.
• Read one real token's iss, and set ORY_OAUTH2_ISSUER in Vercel if it differs from the SDK URL.
• Merging deploys staging, and the next release deploys production. See the runbook in feat: share one Ory login session between S3 credentials and the source.coop API source-coop-cli#23, steps 1, 2, 3 and 5.
• Rollback is a revert: only Ory-token calls are affected.

Docs:

• ADR-005: amended in docs(adr): amend ADR-005 — the API also accepts Ory access tokens data.source.coop#254. It said the API authenticates proxy-signed tokens; it now records the second signer.
• OpenAPI: the bearerAuth description names source-coop login and source-coop auth token.
• public/llms.txt: checked. Its line ("a token from the CLI's login or a service account") still holds.
• docs.source.coop: checked. No page describes calling the API with a token yet.

Testing

• npm run type-check passes.
• npx jest src/app/api src/lib: 535 passed across 53 suites, including new suites for the Ory verifier and for getApiSession's routing.
• next lint on the changed files reports nothing.
• Not run against real Ory: the client configuration doesn't exist yet.

Related

• CLI login session, which sends these tokens: feat: share one Ory login session between S3 credentials and the source.coop API source-coop-cli#23
• CLI product commands: feat: add product commands and a gh-style api command source-coop-cli#24
• ADR-005 amendment: docs(adr): amend ADR-005 — the API also accepts Ory access tokens data.source.coop#254
• Deployment runbook: in feat: share one Ory login session between S3 credentials and the source.coop API source-coop-cli#23

🤖 Generated with Claude Code

https://claude.ai/code/session_017poyHYEyxWEJct9X8Q71qF

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
source-coop-ui	Ready	Preview	Oct 9, 2026 7:14pm UTC
source-cooperative	Ready	Preview	Oct 9, 2026 7:14pm UTC

[claude]

Claude finished @alukach's task in 16s —— View job

---

✅ No blocking issues — safe to merge.

I read the full diff. The Ory verifier pins RS256 and checks issuer, audience and expiry, with a 30s tolerance. Routing on the unverified iss only chooses a verifier and is never trusted. A rejected Ory token doesn't fall back to the proxy verifier or the cookie, and the subject is looked up only as a person's identity (fetchByOryId). Sharing sessionForAccount means both token types get identical disabled-account and membership handling. I found no correctness or security problems.

Not run: I didn't execute type-check or tests.

Simplify (ponytail)

• src/lib/api/utils.ts (new bearer parsing): authorization.toLowerCase().startsWith("bearer ") ? authorization.slice(7) : "" repeats header parsing that authenticateWithOidcToken already does. It's small and fine for now. If a third token type appears, extract one bearerToken(req) helper.
• src/lib/api/ory-access-token.ts (_setOryJwks): this copies the test hook from oidc.ts. It's consistent with the existing code, so keep it.

Docs

• The description still contains unfilled template placeholders: {{CLI_LOGIN_PR}}, {{ADR_PR}} and {{CLI_PRODUCT_PR}}. The ADR-005 amendment link and the deployment runbook reference are therefore unresolvable. Replace them with the real PR links before merge.
• Otherwise the description does what CLAUDE.md asks. It names ADR-005 (amended), llms.txt (checked, still holds) and docs.source.coop (checked, no page covers it).
  · branch feat/api-ory-access-tokens

---

💰 Estimated review cost: $0.15 · 0m16s · 4 turns