#26 Remove bearer token authentication fallback from AppView

closed high · sable · 2026-03-02 23:37 · closed 2026-03-02 23:37 · security · Phase 4: AppView + Web UI

Comments — 1

sable note 2026-03-02 23:37

Bearer token is a shared secret — anyone with it can query any DID's inbox. This defeats DID-scoped auth entirely. Remove bearer token as an auth method. DID-scoped Ed25519 is the only auth path. Config field auth_token removed. BearerToken extension removed from router.

Generated 2026-03-03 02:53 UTC