Portal link: send the instance credential as Authorization: Bearer

Not ?token= in the tunnel URL, which access logs keep. The hub has to be upgraded first; websockets>=14 for additional_headers on the asyncio client.
2026-10-07 09:41:44 +02:00
parent 1424e1e8a8
commit e9c3d0944d
5 changed files with 45 additions and 5 deletions
@@ -49,6 +49,12 @@ Once enrolled, the instance appears under **Instances** with its
 status, when it was last seen and its version. **Open** takes you to its
 dashboard at `${DOMAIN}/i/{instance-id}`.

+**Upgrade a self-hosted portal before its instances.** An instance dials the
+tunnel with its credential in an `Authorization` header, where it stays out of
+access logs, and a portal from before that reads it only from the URL. The
+portal still takes the old `?token=` for one release, so older instances keep
+attaching meanwhile.
+
 ## What the portal can and cannot do

 The portal holds one credential for your instance and proxies requests down