Provide the ability to pass the token via HTTP headers instead of a query parameter #1344

Activity

1. netomi commented on Feb 11, 2026

   

   netomi

   on Feb 11, 2026

   Contributor

   More actions

   Here is a good argument to put the token into the header rather pass it as query parameter: https://stackoverflow.com/questions/5517281/place-api-key-in-headers-or-url
2. netomi

   added

   server(Component: server) Backend platform and service-side functionality(Component: server) Backend platform and service-side functionality

   securityVulnerabilities or improvements to harden security and protect user dataVulnerabilities or improvements to harden security and protect user data

   apiPublic and internal APIs supporting extension registry featuresPublic and internal APIs supporting extension registry features

   on Feb 16, 2026
3. netomi

   assigned

   cstamas

   on Sep 12, 2026
4. netomi commented on Sep 12, 2026

   

   netomi

   on Sep 12, 2026

   Contributor

   More actions

   We should prioritize that for the next minor version we are working on. We should start by replacing all existing endpoints that require a token to make the token optional and use an http header again for authentication. If this is not feasible, add endpoints w/o token and mark the ones with token as deprecated.

   Once the cli and webui are fully migrated to the new endpoints, we can remove them in the next release.
5. cstamas

   added a commit that references this issue on Sep 14, 2026

   fix: address PR review feedback on token-via-header support

   ...

   32a6e2a
6. netomi

   closed this as completedin #2209on Sep 25, 2026