[SC-16780] Allow machine keys on admin endpoints#122
Merged
even-steven merged 2 commits intoJun 30, 2026
Merged
Conversation
Extend AdminMiddleware to accept X-API-Key / X-API-Secret as a trusted machine-caller path in addition to the existing OAuth Bearer-token path. When valid machine key credentials are present, the request is admitted immediately without requiring a JWT. Wrong keys short-circuit with 401 rather than falling through to the Bearer path. No API-key headers falls through to the existing Bearer validation for human admin UI logins. This lets server-to-server callers (e.g. the ValidMind backend proxy) use the same static credentials they already have for reporting endpoints, removing the need for a separate admin_bearer_token config or a Keycloak service-account client-credentials flow. Co-authored-by: Cursor <cursoragent@cursor.com>
|
|
even-steven
requested review from
gtagle,
hunner,
mdeyell-valid-mind and
nibalizer
Contributor
|
The code looks good but the toml comment for [api_key] should be updated. The docs should also mention that [api_key] now can be used to access the admin endpoints when it is set |
Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
Done, thank you |
mdeyell-valid-mind
approved these changes
Jun 29, 2026
even-steven
deleted the
stevenchand/sc-16780/aa-embed-atryum-functionality-in-validmind
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AdminMiddlewareto acceptX-API-Key/X-API-Secretas a trusted machine-caller path on admin endpoints (/api/v1/admin/...), in addition to the existing OAuth Bearer-token path used by the human admin UIadmin_bearer_tokenconfig or Keycloak service-account client-credentials flow neededTest plan
go test ./internal/auth/...— all existing tests pass, newTestAdminMiddlewareMachineKeyBypassesBearercovers valid keys, wrong secret, and Bearer fallbackvm_to_atryum_api_key/vm_to_atryum_api_secretfrom vmconfigX-API-Keyheaders sent from browser)Made with Cursor