Skip to content

fix(server): deprecate query-string API keys and add telemetry (#27) - #37

Open
Adityakk9031 wants to merge 1 commit into
agentmail-to:mainfrom
Adityakk9031:#27
Open

fix(server): deprecate query-string API keys and add telemetry (#27)#37
Adityakk9031 wants to merge 1 commit into
agentmail-to:mainfrom
Adityakk9031:#27

Conversation

@Adityakk9031

Copy link
Copy Markdown

Summary

Addresses #27 by starting the sunset phase for legacy query-string API keys (?apiKey=...) on the MCP server endpoint and promoting header-based authentication.

Changes Made

  • Updated noAuthMessage: Removed ?apiKey=YOUR_KEY from unauthenticated server response messages. Instructs clients to use x-api-key header or Authorization: Bearer am_....
  • Added Telemetry Logging: Added a value-free warning log ([telemetry] Legacy query-string API key auth used (sunset scheduled)) in authRouter whenever req.query.apiKey is present to monitor legacy usage prior to total removal.

Related Issues

Closes #27

@Adityakk9031

Copy link
Copy Markdown
Author

@SanjithSambath have a look

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Backend follow-up: sunset query-string API keys; confirm WS handshake header auth

1 participant