Service
The public catalogue
Where a service lives and which header it wants is the same for everyone. The catalogue holds that; only the key and the permission are yours.
Two files, and only one of them holds a secret. The catalogue is public and ships with the binary: what each service is, its base URL, whether the key travels in a header or a query parameter, and which methods and paths are allowed. The config is private, root-owned, and holds your keys and who may use them. Supporting a new service is a catalogue update, never something anyone does by hand on their own box.
The credential is placed by stripping the slot first and setting ours second — never setting alone. Both transports allow repetition: HTTP permits repeated header names, a query string permits the same parameter twice. Which one an upstream honours is not something to bet a credential on. Header names are matched case-insensitively; query parameters are matched after percent-decoding, so a disguised duplicate cannot ride along.
On the way back, a query-mode upstream that redirects echoes the request URL — credential included — in its Location header. Response headers are scrubbed of the injected parameter by name, and the broker never follows redirects.
Shipped to /usr/share/authinjector/ on every host. Public by design.
Am I in your service area?
Enter your postal code or city and we'll check the drive time from our shop.
