docs(drift): draft from internal source - #444
Conversation
Requested by @Frizellle via /publish-docs-pr
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
|
| method: "POST", | ||
| headers: { | ||
| "Content-Type": "application/json", | ||
| "Authorization": `Bearer ${API_KEY}`, |
There was a problem hiding this comment.
Route Racing API key is sent through the wrong header
The example uses Authorization: Bearer ${API_KEY}, but Relay API keys are supplied through x-api-key. The quote endpoint accepts the copied request as an unauthenticated public quote, which masks the issue; however, it cannot identify the key whose Route Racing grant should be applied. Use "x-api-key": API_KEY so copied integrations can opt into the key-scoped feature.
Artifacts
Route Racing API-key header validation source
- Executable validation source posts the same route-racing quote payload with the copied Bearer header or the documented x-api-key header, using a non-secret invalid key; it provides the reproducible comparison.
Before response using the copied Authorization Bearer header
- Captured execution of the copied documentation request against Relay quote v2, which returned HTTP/1.1 200 OK as a public quote; the takeaway is that acceptance does not apply a per-key grant.
After response using the documented x-api-key header
- Captured execution of the same Relay quote v2 request with x-api-key, which returned HTTP/1.1 200 OK; the takeaway is that this is the documented channel for key-scoped behavior.
Drafted from an internal source repo, requested by @Frizellle.
This PR was auto-generated by the
reusable-docs-draft-prworkflow from a Claude-drafted update in the source repo. It is opened as a draft — please review, edit as needed, and mark ready for review before merging.Review checklist
CLAUDE.mdstyle rulesNeeds human inputitems from the source comment are addressedGenerated by
reusable-docs-draft-pr.ymlinrelayprotocol/agents-config.