Repository navigation

Add rotatable proxy tokens and a proxy-only key for internal API routes - #378

Merged

Brooooooklyn merged 12 commits into

security/1a-quick-fixesfrom

security/1b-proxy-token-v2

Oct 8, 2026

Merged

Add rotatable proxy tokens and a proxy-only key for internal API routes#378
Brooooooklyn merged 12 commits into
security/1a-quick-fixesfrom
security/1b-proxy-token-v2

Commits on Oct 8, 2026
- Add the generation-based proxy token module
  
  Brooooooklyn
  and
  claude
  authored
  d1eae71
- Accept v2 proxy tokens alongside the legacy token
  
  Brooooooklyn
  and
  claude
  authored
  520546a
- Send the issued proxy token generation to tenant Workers
  
  Brooooooklyn
  and
  claude
  authored
  8f0d25c
- Sign proxy-to-API metadata calls with a proxy-only key
  
  Brooooooklyn
  and
  claude
  authored
  ecff301
- Issue proxy tokens from the accept floor
  
  Brooooooklyn
  and
  claude
  authored
  fedb65d
- Retry cron fires and queue relays with a fallback token
  
  Brooooooklyn
  and
  claude
  authored
  4757cec
- Skip unknown cleanup jobs instead of deleting them
  
  Brooooooklyn
  and
  claude
  authored
  3af9d92
- Document proxy token generations for maintainers
  
  Brooooooklyn
  and
  claude
  authored
  4532d3e
- Cover floor 2 in proxy token state table and rewrap proxy README
  
  Brooooooklyn
  and
  claude
  authored
  2729af3
- Bound the proxy's read of a tenant 403 before retrying
  
  Brooooooklyn
  and
  claude
  authored
  bc360f0
- Drop the version marker from proxy tokens and keys
  
  Brooooooklyn
  and
  claude
  authored
  acb2624
- Send one proxy token and never replay a rejected request
  
  Brooooooklyn
  and
  claude
  authored
  a1431cc