[RhysSullivan]

When v1 forwards an MCP request of a moved organization to v2, the signed v1fwd token now carries an optional apiKey claim for callers that authenticated with a WorkOS API key:

"apiKey": { "id": "<key id>", "organization": "<the key's own org id>", "hash": "<sha256, unpadded base64url>" }

v2 stores every forwarded WorkOS API key as a native key, so those keys keep working after v1 shuts down. The hash is computed in verifyApiKey from the exact bearer v1 validated (same value as Better Auth's defaultKeyHasher), carried on the verified token and principal, and passed to mintForwardToken. AuthKit JWT callers get no apiKey. Everything else in the token, headers and responses is unchanged.

The hash only travels inside the HMAC-signed bearer over the V2_MCP service binding. It is never logged and never put on a span.

Tests:

• v2-forward.test.ts: payload key order with apiKey last, an API-key caller's forwarded token carries the key id, the key's organization and the hash (computed independently with node:crypto), a caller without a key gets no apiKey, and the HMAC signature verifies.
• auth-provider.test.ts: the real McpAuthLive over a stubbed key lookup puts the hash on the principal while the URL still selects the organization; a JWT caller's principal has no apiKey.
• agent-handler.test.ts: the principal's key reaches forwardToV2.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2556

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2556

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2556

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2556

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2556

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2556

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2556

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2556

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2556

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2556

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2556

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2556

executor

npm i https://pkg.pr.new/executor@2556

commit: ecad0f4

[RhysSullivan]

Closing: v1 is frozen, and the API key capture moves into Executor v2 instead.

Sent from my Claude