Namespace Virtufin.Api.Auth

Classes

ApiKeyAuthOptions

API-key authentication configuration for the gRPC surface. Keys are named so successful calls can be attributed to a caller in logs. When no keys are configured, authentication is disabled (local dev default).

ApiKeyHttpMiddleware

Enforces x-api-key on the HTTP surface (the hand-written minimal-API endpoints such as /v1/grpc/call, the OpenAPI/Scalar docs, and JSON-transcoded gRPC). Native gRPC and gRPC-web calls carry their own ApiKeyInterceptor and are skipped here so they keep proper gRPC status codes. Health probes stay open.

Without this, exposing the gRPC port through an ingress would also expose those HTTP endpoints — which bypass the gRPC interceptor entirely — with no authentication. Active only when Enabled.

ApiKeyInterceptor

Server interceptor enforcing x-api-key authentication on every gRPC call (including JSON-transcoded ones) when Enabled. Health-check methods stay open so probes and load balancers keep working, and so do the Dapr sidecar's own app callbacks (see Virtufin.Api.Auth.ApiKeyInterceptor.DaprAppCallbackPrefix).