The ParaSend account key never reaches the browser: a scoped session token - #401

Merged

Apolloccrypt merged 7 commits into

mainfrom

feat/parasend-session-token

Sep 3, 2026

Commits on Sep 3, 2026

Relay: a ParaSend session token, so the account key can leave the browser
Apolloccrypt
committed
62a99c0
ParaSend: the account key stays on the server, the browser gets a session token
Apolloccrypt
committed
417a20f
Draw the line between the two Bearer credentials the relay now has
Apolloccrypt
committed
27635c4
One mint attempt per relay call, not two
Apolloccrypt
committed
c73fe37
Say which pages hold the API key, not just the one that stopped
Apolloccrypt
committed
e112535
Harden the session-token record: hash the owner, require the expiry, mark the audit
Apolloccrypt
committed
499be50
Merge branch 'main' into feat/parasend-session-token
Apolloccrypt
authored
f42344d