Authentication

GET /api/health is public. Every other route requires credentials.

The OpenAPI spec only declares ApiKeyAuth (X-API-Key). The server also accepts OIDC bearer tokens. Either credential is enough; they are not exclusive. A valid API key is accepted even if Authorization is present and invalid. Implementation: src/pipeline/internal/api/middleware.go.

OIDC (console users)

Authorization: Bearer <id-token>

Works against any standards-compliant OAuth2/OIDC provider — AWS Cognito, Auth0, Okta, Keycloak, etc. At startup the server discovers the issuer's .well-known/openid-configuration and JWKS from FALCONTALON_OIDC_ISSUER_URL, then verifies each bearer token's signature, issuer, and audience (FALCONTALON_OIDC_CLIENT_ID). Subject stored as oidc_sub. If the issuer URL is unset, this path is disabled and the API logs that only the API key works.

The console sends the ID token, not the access token — the backend verifies a spec-defined ID token (sub/iss/aud claims), and Cognito access tokens in particular carry no aud claim. The console keeps this token in sync via the OIDC client's automatic silent renew. A console API key can be stored in localStorage and is sent on every request when set, including alongside an OIDC session. The console does not require signing in when an API key is used.

API key (workers and tooling)

X-API-Key: <FALCONTALON_KEY_API>

Compared in constant time. Query-string keys are rejected.

Workers always use the API key. CORS allows Content-Type, X-API-Key, and Authorization. The API does not use cookies.

Failures

Missing or invalid credentials → 401 { "error": "unauthorized" }.