From d1040d817d22dae4519f014793d92cb0daec11a9 Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Mon, 12 Oct 2026 21:54:05 -0400 Subject: [PATCH 1/2] test(conformance): read SEAMLESS_SERVICE_TOKEN in the reference apps The reference apps are app-side, so they read the service token from SEAMLESS_SERVICE_TOKEN. The auth API in the conformance stack still reads API_SERVICE_TOKEN with the same value. --- .github/workflows/ci.yml | 2 +- conformance/_shared.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 20b8573..4010d2b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,7 +65,7 @@ jobs: PORT: '8080' AUTH_SERVER_URL: http://localhost:5312 AUTH_SERVER_ISSUER: http://auth-api:5312 - API_SERVICE_TOKEN: verify-dev-service-token-not-a-real-secret + SEAMLESS_SERVICE_TOKEN: verify-dev-service-token-not-a-real-secret COOKIE_SIGNING_KEY: verify-dev-service-token-not-a-real-secret JWKS_KID: dev-main run: | diff --git a/conformance/_shared.py b/conformance/_shared.py index 15ddfef..b46d7dd 100644 --- a/conformance/_shared.py +++ b/conformance/_shared.py @@ -41,7 +41,7 @@ def adapter_options() -> dict[str, Any]: "auth_server_url": os.environ.get("AUTH_SERVER_URL", ""), "auth_server_issuer": os.environ.get("AUTH_SERVER_ISSUER") or None, "cookie_secret": os.environ.get("COOKIE_SIGNING_KEY", ""), - "service_secret": os.environ.get("API_SERVICE_TOKEN", ""), + "service_secret": os.environ.get("SEAMLESS_SERVICE_TOKEN", ""), "jwks_kid": os.environ.get("JWKS_KID") or None, "deliver": capture, "resolve_client_ip": one_trusted_hop, From 034b7faea1e08acb0fee117e34c9046fc8dd9545 Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Mon, 12 Oct 2026 21:54:05 -0400 Subject: [PATCH 2/2] docs: name the app-side service token SEAMLESS_SERVICE_TOKEN The examples read the service token from SEAMLESS_SERVICE_TOKEN. The auth server keeps reading API_SERVICE_TOKEN; both hold the same value. --- README.md | 11 +++++++---- src/seamless_auth/django.py | 2 +- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 74544f3..a1b827e 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ from seamless_auth.fastapi import RequireUser, auth_router auth = Adapter( auth_server_url=os.environ["AUTH_SERVER_URL"], cookie_secret=os.environ["COOKIE_SECRET"], # at least 32 bytes - service_secret=os.environ["SERVICE_SECRET"], # the API's API_SERVICE_TOKEN + service_secret=os.environ["SEAMLESS_SERVICE_TOKEN"], # the API's API_SERVICE_TOKEN value jwks_kid=os.environ["JWKS_KID"], ) current_user = RequireUser(auth) @@ -55,6 +55,9 @@ def me(user: User = Depends(current_user)): return {"id": user.id} ``` +The auth server reads the service token from `API_SERVICE_TOKEN` and your app reads it from +`SEAMLESS_SERVICE_TOKEN`; both hold the same value. + `RequireUser` answers 401 unless the request carries a session, and returns the `User`. ## Django @@ -64,7 +67,7 @@ def me(user: User = Depends(current_user)): SEAMLESS_AUTH = { "auth_server_url": os.environ["AUTH_SERVER_URL"], "cookie_secret": os.environ["COOKIE_SECRET"], - "service_secret": os.environ["SERVICE_SECRET"], + "service_secret": os.environ["SEAMLESS_SERVICE_TOKEN"], "jwks_kid": os.environ["JWKS_KID"], } @@ -117,7 +120,7 @@ JSON it would be a sign-in the user never made. The client SDKs already send JSO | `auth_server_issuer` | the URL | Expected `iss` of the API's tokens, when it differs from the URL you reach it at | | `audience` | the issuer | Expected `aud` of the API's tokens | | `cookie_secret` | required | Signs the session cookies (32 bytes or more) | -| `service_secret` | required | The API's `API_SERVICE_TOKEN` (32 bytes or more) | +| `service_secret` | required | The service token, read from `SEAMLESS_SERVICE_TOKEN` in the examples; the same value as the API's `API_SERVICE_TOKEN` (32 bytes or more) | | `jwks_kid` | `dev-main` | `kid` header on service tokens | | `cookie_domain` | none | Cookie `Domain` | | `insecure_cookies` | `False` | Drops `Secure`, for local development over HTTP | @@ -209,7 +212,7 @@ one locally you need Docker, a checkout of `seamless-auth-api` and the `seamless ```bash PORT=8080 AUTH_SERVER_URL=http://localhost:5312 AUTH_SERVER_ISSUER=http://auth-api:5312 \ - API_SERVICE_TOKEN=verify-dev-service-token-not-a-real-secret \ + SEAMLESS_SERVICE_TOKEN=verify-dev-service-token-not-a-real-secret \ COOKIE_SIGNING_KEY=verify-dev-service-token-not-a-real-secret JWKS_KID=dev-main \ uv run python conformance/fastapi_app.py & # or conformance/django_app.py diff --git a/src/seamless_auth/django.py b/src/seamless_auth/django.py index 8a3c1d9..3b49c5d 100644 --- a/src/seamless_auth/django.py +++ b/src/seamless_auth/django.py @@ -6,7 +6,7 @@ SEAMLESS_AUTH = { "auth_server_url": env("AUTH_SERVER_URL"), "cookie_secret": env("COOKIE_SECRET"), - "service_secret": env("SERVICE_SECRET"), + "service_secret": env("SEAMLESS_SERVICE_TOKEN"), "jwks_kid": env("JWKS_KID"), }