Skip to content

Api key auth#2062

Merged
alexgshaw merged 5 commits into
harbor-framework:mainfrom
scvance:api-key-auth
Jun 23, 2026
Merged

Api key auth#2062
alexgshaw merged 5 commits into
harbor-framework:mainfrom
scvance:api-key-auth

Conversation

@scvance

@scvance scvance commented Jun 23, 2026 •
edited by devin-ai-integration Bot
Loading

Copy link
Copy Markdown
Contributor

This PR adds v1 of API key authentication to the CLI interface

How to use

Set the environment variable HARBOR_API_KEY=sk-harbor-... before running your harbor commands.

How it works

The CLI will exchange the key for a short-lived Supabase JWT at the hub's new api-key-exchange endpoint. It will use the short-lived JWT for all hub requests without requiring harbor auth login

  • harbor/auth/api_key.py (new) will read HARBOR_API_KEY, post that to the exchange function, and cache the JWT against the expires_in claim, and re-exchange before expiry.
  • harbor/auth/client.py is updated so create_authenticated_client will build a client carrying the exchanged JWT as the bearer
  • reset_client invalidates the token. We re-exchange mid-run if needed.
  • harbor/auth/session.py makes identity-dependent flows read the user id from the JWT sub and use the token as the bearer instead of querying GoTrue.
    • The server will still verify the signature on every request
  • harbor/cli/auth.py makes it so harbor auth login warns when HARBOR_API_KEY is set since the key takes precedence

Precedence

HARBOR_API_KEY > harbor auth login

Scope

  • Harbor API keys grant full-access to user account in v1. Will introduce scoped API keys in a later release
Open in Devin Review

scvance and others added 2 commits June 22, 2026 17:48
@scvance
fixed session authentication problem by reading user_id from JWT clai…
0623188 
…ms. Actual authentication still happens supabase side
@scvance @claude
feat(auth): warn at login when HARBOR_API_KEY overrides the session
4ad994f 
`harbor login` still completes when HARBOR_API_KEY is set, but every command
then authenticates with the API key (the env var takes precedence over the
stored login session), which is easy to miss. Emit a stderr warning at login
when the key is set so the override is visible.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Enjoy a better diff viewing experience by clicking one of these URLs:

devin-ai-integration[bot]

This comment was marked as resolved.

Sign in to view

devin-ai-integration[bot]

This comment was marked as resolved.

Sign in to view

devin-ai-integration[bot]
devin-ai-integration Bot reviewed Jun 23, 2026
View reviewed changes

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 2 new potential issues.

Open in Devin Review

Comment thread src/harbor/auth/session.py
Comment thread src/harbor/auth/client.py
@alexgshaw alexgshaw merged commit 84b2a96 into harbor-framework:main Jun 23, 2026
10 checks passed
@alexgshaw alexgshaw mentioned this pull request Jul 3, 2026
Closed
Messimeimei added a commit to Messimeimei/bitfun-harbor that referenced this pull request Jul 7, 2026
@Messimeimei @cursoragent
Sync harbor-framework through v0.16.0
6dc71a1 
338b7d0 Add per-agent concurrency limits and agent-end hooks (harbor-framework#2014)
a264cef Add Blaxel network policy and DinD support (harbor-framework#1980)
d0e0869 feat(agents): propagate AgentConfig.env to all agent load paths (harbor-framework#1967)
4b09d97 feat: mvp for run launcher directly in viewer (harbor-framework#2017)
e266675 feat: implement git repo skills (harbor-framework#1909)
31b38dd Skip uv download if already installed for mini swe agent (harbor-framework#1952)
c6f4898 Refactor Harbor task handling and viewer UI (harbor-framework#2023)
19585c3 feat(atif): bring installed-agent trajectory converters to full ATIF v1.7 fidelity (harbor-framework#1888)
6485949 Add EC2 sandbox environment (harbor-framework#2031)
c004b05 [CI] Post adapter validation as a fresh timestamped comment (harbor-framework#2040)
6671d38 Handle API usage limit errors (harbor-framework#2037)
34e545b add `harbor run --install-only` flag (harbor-framework#1983)
c2e11d6 ci: update to windows server 2025 (harbor-framework#2033)
20160fc fix(swe-agent): don't let testbed-conda.sh abort under set -u (harbor-framework#2039)
7657d45 feat: combine --agent-import-path into --agent (harbor-framework#1988)
496293b test(pass-at-k): add unit tests for pass@k metric utility (harbor-framework#2046)
472bf7e fix(docker): fall back to tar upload when compose cp fails (harbor-framework#1944)
1cd8438 feat(cli): add agent/verifier log-filter flags to `harbor trial start` (harbor-framework#2047)
8cf5fdf fix(openhands-sdk): use uv to pin Python >=3.12 for SDK venv (harbor-framework#2041)
84b2a96 Api key auth (harbor-framework#2062)
52a31c3 Network mode support for docker environment (harbor-framework#1799)
3751070 Preview task definition image files (harbor-framework#2055)
0e8ae01 Add bash action, start_url, and configurable IO dir to computer-1 (harbor-framework#2042)
87c3c47 Minor updates.
f3e7488 Merge branch 'main' of github.com:harbor-framework/harbor
c0cecbb fix(resume): tolerate empty/truncated result.json on resume (harbor-framework#2053)
dcaaebe default internet (harbor-framework#2066)
629f8ae Fix Gemini CLI JSONL session handling (harbor-framework#2069)
86d3bc0 fix(llms): cap Anthropic cache_control breakpoints at 4 (harbor-framework#2072)
4e6dfd6 Harden Kimi CLI runtime configuration (harbor-framework#2070)
0bc7e18 deps: pin transformers>=5.3.0 to fix CVE-2026-4372 (harbor-framework#2004)
6e2d9f5 Fix mini-swe-agent ATIF steps for responses API (harbor-framework#2073)
f7110f1 feat(launcher): multi-agent/multi-dataset run launcher w/ configs (harbor-framework#2057)
053c05c feat(env): add Cua Cloud environment for desktop VMs (harbor-framework#1957)
5afda90 Add Codex web search CLI flag (harbor-framework#2032)
c390779 Reorganize example configs by category (harbor-framework#2083)
0cdf5cf Add max_tokens support to MiniSweAgent (harbor-framework#2082)
bd5005c Refine trial viewer typography and step detail interactions (harbor-framework#2077)
a7667a0 fix(langgraph): forward task-environment MCP servers to the graph (harbor-framework#2085)
7ae9ee0 feat(agents): skip install for pre-built images (auto-detect + guarded mkdir) (harbor-framework#1970)
6fca45a feat: reload past run configs (harbor-framework#2076)
3fb4a92 Link observation results to source tool calls (harbor-framework#2087)
e90f959 feat(viewer): save launcher config as YAML (harbor-framework#2089)
575a102 Remove job plugins from config files (harbor-framework#2074)
4340b0c Move verifier job options into a dedicated help panel (harbor-framework#2019)
701c90a feat(modal): add dynamic network policy switching (harbor-framework#2003)
703747d Toggle modal dynamic network configuration based on phase_network_policies (harbor-framework#2092)
ff7e1a5 feat(rewardkit): opt-in cross-dimension aggregation for reward.json (harbor-framework#2010)
6712637 feat: launcher browse dataset path (harbor-framework#2093)
0de1cd4 Fix mswea reasoning.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments
@alexgshaw alexgshaw alexgshaw approved these changes

Assignees

No one assigned

Labels

area:cli area:registry

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@scvance @alexgshaw