Skip to content
SecurityAgent-ready

API authentication accepts session tokens and workspace headers

The API now accepts first-party session tokens alongside API keys, and the x-tenant-id header is validated against your workspace membership before taking effect.

Two authentication improvements shipped together to tighten access control across the API.

  • First-party session tokens are now accepted on all authenticated API routes, so browser-based flows no longer require a separate API key
  • x-tenant-id is now validated against the caller's workspace membership; unrecognized or unauthorized values are rejected rather than passed through
  • Staff email allowlist is honored even when the database promotion step fails, preventing lockouts during degraded states