Files
heicode/docs/integration
chenchenandClaude Opus 4.8 b01bba53f0 docs(agent): lock client↔agent auth to option ① (agent-local token compare)
Per the chosen design, the agent authorizes callers by comparing the request
header X-Agent-Access-Token against its env AGENT_ACCESS_TOKEN (constant-time),
no HM round-trip. AM contract §3.1 now states ① as the agreed integration with
Python pseudo-code; the /agent-access/verify endpoint is demoted to an optional
fallback. Client API §6 spells out the client's job: send X-Agent-Access-Token
on every direct-connect request.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-04 22:23:41 +08:00
..