Repository navigation
feat: agent keys as Authorization: Bearer, per-client MCP setup in Studio - #38
Merged
Merged
Conversation
Most MCP clients and Codex's `bearer_token_env_var` send `Authorization: Bearer <key>`; the API only read `x-api-key`. The principal resolver now takes either (`agentKeyFrom`). `/api/admin/*` keeps its deployment-token bearer and never reads it as an agent key; an unknown bearer is refused rather than falling back to the browser session. Shared suite on better-sqlite3 and D1: REST and /mcp with Bearer, unknown bearer, session fallback, deployment token on /api/admin. Docs: every remote client example sends Bearer (Codex via bearer_token_env_var); x-api-key stays documented as equivalent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>
…reveal `McpClientSetup` picks a client (Claude Code, Codex, Cursor, VS Code, any other; local stdio in the page's card) and shows its ready-to-copy setup for this deployment's /mcp, in the formats of docs/agents/clients.md. Right after a key is created the secret is filled in; VS Code prompts for it instead of storing it in the file. All remote snippets send Authorization: Bearer. Strings in en.ts; other languages drafted through i18n:export/import (AI drafts awaiting review). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>
This was referenced Oct 21, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
API (
@cloudhal/api, changeset: minor)/mcp(and/api/me, the only REST route agent keys reach) accept the agent key asAuthorization: Bearer <key>as well asx-api-key(agentKeyFrominauth/types.ts, used byresolvePrincipal). This is what most MCP clients and Codex'sbearer_token_env_varsend./api/admin/*keepsAuthorization: Bearer <CLOUDHAL_DEPLOY_TOKEN>: the bearer there is never read as an agent key, and an agent key there still gets 401.testing-agent-key-auth.tsruns on better-sqlite3 and Miniflare D1.Studio
McpClientSetupcomponent: pick a client (Claude Code, Codex, Cursor, VS Code, Other; Local (stdio) in the page card) and get ready-to-copy setup for this deployment's/mcp.CLOUDHAL_API_KEYthrough--bearer-token-env-var.Authorization: Bearer. The card's header row now shows that too.en.ts. The other 18 languages were drafted throughi18n:export/i18n:import; they are AI drafts awaiting review.Docs
docs/agents/clients.md: every remote example sends Bearer; Codex usesbearer_token_env_var. It notes thatx-api-keystill works.docs/agents/README.md,docs/security/threat-model.mdand ADR-0011.Checks (run one after another)
packages/api: full vitest run, 30 files / 371 tests passing, including the new suite (8 tests).apps/studio:tsc --noEmit, full vitest run (one design-rules failure, fixed by pointing the required blocks atMcpClientSetup), then the touched suites again: 549 passing.pnpm design:lintclean;pnpm size:checkok (theCreateAgentKeyDialogbaseline went down).pnpm design:shotsof/agentsand the key reveal at 1440 and 390 px, against a local throwaway project: no sideways scroll, no console errors.🤖 Generated with Claude Code