Authentication
Every call except the public ones below sends Authorization: Bearer <token>.
Compute Gateway takes no other identity headers: who the caller is comes only
from the verified token. Who a module runs for comes from the module_ref in
the request, and what it may do comes from the Granite grant; see
Concepts.
The two credentials
| Credential | Accepted by the live service? |
|---|---|
| Person: a ChirpAuth ID token issued to Compute Gateway’s own sign-in | Yes |
| Machine: a ChirpAuth machine token from an accepted client | No; no machine client is accepted today |
Person token
Authorization: Bearer <ChirpAuth ID token>
- Only ID tokens issued to Compute Gateway’s own ChirpAuth sign-in are
accepted. Tokens issued to other ChirpAuth apps are refused with
401. - The token’s subject is the person. Linking Model Gateway and registering connectors act for that person.
- Not yet: Compute Gateway has no sign-in page or app, and Stackwell does not issue these tokens to outside developers.
Machine token
The code accepts ChirpAuth machine tokens from clients Compute Gateway is
configured to accept, but the live service is configured to accept none, so
every machine token gets 401.
What each credential allows
| Endpoints | Person token | Machine token |
|---|---|---|
POST /v1/compute/invoke, POST /v1/compute/runs, POST /v1/compute/runs/{id}/tick, GET /v1/compute/runs/{id} | Accepted | Accepted where enabled |
POST /v1/nora/interactive-runs, POST /v1/nora/interactive-runs/{id}/messages | Accepted | Accepted where enabled |
POST /v1/model/link, POST /v1/model/link/resolve, POST /v1/model/credentials, POST /v1/model/spend-grants, POST /v1/model/spend-grants/resolve | Accepted | 403 |
POST /v1/spend/wallet-grant, POST /v1/spend/wallet-grant/resolve | Accepted | 403 |
POST /v1/connectors, GET /v1/connectors/{name} | Accepted | 403 |
No credential
GET /health (liveness) and a diagnostics endpoint need no Authorization
header.
curl -fsS https://j5afbrmr6qzrwewgxdwacvmedq0ylxvy.lambda-url.us-east-1.on.aws/health
Any other endpoint without a token, or with one Compute Gateway does not
accept, returns 401:
curl -sS https://j5afbrmr6qzrwewgxdwacvmedq0ylxvy.lambda-url.us-east-1.on.aws/v1/connectors/example | grep -Fx '{"error":"unauthorized"}'