Repository navigation
Allow overriding the API token with DEV_PROXY_API_TOKEN - #2010
Merged
Merged
Conversation
Lets orchestrators such as the Aspire integration start Dev Proxy with a known API token instead of reading per-process token files. Values are trimmed, must be at least 32 characters, and must be valid Bearer token characters; invalid values stop startup with a clear error. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Startup validation can block non-startup commands and checks the inherited token before configuration and CLI environment overrides are applied.
2 open issues
What changed in this PR
Adds a configurable API token so orchestrators such as Aspire can authenticate with Dev Proxy without reading per-process credential files.
Changes:
- Adds
DEV_PROXY_API_TOKENresolution, trimming, and validation while retaining random-token fallback. - Adds startup validation and token-resolution unit tests.
- Documents the override in CLI help and configuration guidance.
| File | Description |
|---|---|
skills/dev-proxy/references/configuration.md |
Documents token requirements and retrieval behavior. |
DevProxy/Program.cs |
Adds early token validation for proxy startup. |
DevProxy/Commands/DevProxyCommand.cs |
Adds the environment override to root help. |
DevProxy/ApiSecurity.cs |
Resolves and validates the token lazily. |
DevProxy.Tests/ApiSecurityTokenTests.cs |
Tests fallback, overrides, trimming, and invalid values. |
Review effort: Balanced
- Restore CRLF line endings in Program.cs and DevProxyCommand.cs - Resolve and validate the token in the root command after config env and --env overrides are applied, logging a clean error and exiting with 1 - Limit the early check to the detached parent, honoring its --env value and skipping help, version, and subcommands - Don't check the token for stdio Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The detached path is only reached for the root command, so the hard-coded subcommand list isn't needed and would miss plugin commands. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivated by dev-proxy-tools/aspire#55, which adds Aspire dashboard commands that start/stop recording through the Dev Proxy API. Today the API token is randomly generated at startup, so the AppHost had to read
credentials/api-<pid>.tokenfiles, which is fragile (Windows paths, stale/shared tokens, container bind-mount permissions). With this change the AppHost generates a token and passes it to thedevproxyexecutable or container through an environment variable.Changes
DEV_PROXY_API_TOKENenv var (named likeDEV_PROXY_CERT_PATH). When it is set and non-empty, Dev Proxy uses it as the API token. Otherwise it generates a random token as before.A-Z a-z 0-9 - . _ ~ + /plus trailing=). An invalid value stops startup (root, detached andstdio) with a clear error and exit code 1. Other commands such asstatusandstopare not affected.devproxy status,devproxy api tokenanddevproxy stopkeep working. Token display and logging are unchanged.skills/dev-proxy/references/configuration.md.ApiSecurityTokenTestscovering the generated fallback, override, trimming, too-short values and invalid characters.Validation
dotnet build DevProxy.sln -warnaserrorpasses, andDevProxy.Testspasses (126 tests).DEV_PROXY_API_TOKEN=short devproxy --detach ...exits withDEV_PROXY_API_TOKEN must be at least 32 characters long.With a valid 64-character hex token, the API returns 200 for that token and 401 for a different one.devproxy api tokenreturns the override anddevproxy stopworks.