From 37d0ffe3c82b13c34748e5c7f80a9d6038222e85 Mon Sep 17 00:00:00 2001
From: "Odysseas.eth" <odyslam@gmail.com>
Date: Tue, 2 Jun 2026 21:43:44 -0400
Subject: [PATCH] fix(proxy): allow project access token header

---
 services/api/api/iron-proxy.base.yaml   |  1 +
 services/api/tests/test_proxy_config.py | 14 +++++++++++++-
 services/iron-proxy/iron-proxy.yaml     |  1 +
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/services/api/api/iron-proxy.base.yaml b/services/api/api/iron-proxy.base.yaml
index 00a8eb382..1de368fb4 100644
--- a/services/api/api/iron-proxy.base.yaml
+++ b/services/api/api/iron-proxy.base.yaml
@@ -66,6 +66,7 @@ transforms:
         - "api-access-key"
         - "api-signature"
         - "api-timestamp"
+        - "project-access-token"
         - "fx-access-key"
         - "fx-access-sign"
         - "fx-access-timestamp"
diff --git a/services/api/tests/test_proxy_config.py b/services/api/tests/test_proxy_config.py
index 35d65fe2d..0a3ba40bc 100644
--- a/services/api/tests/test_proxy_config.py
+++ b/services/api/tests/test_proxy_config.py
@@ -883,6 +883,15 @@ def test_render_emits_header_and_gcp_auth_transforms(
     assert entry["rules"] == [{"host": "api.openai.com"}]
 
 
+def test_render_allows_project_access_token_header() -> None:
+    cfg = yaml.safe_load(render_proxy_yaml([]))
+    header_allowlist = next(
+        t for t in cfg["transforms"] if t["name"] == "header_allowlist"
+    )
+
+    assert "project-access-token" in header_allowlist["config"]["headers"]
+
+
 def test_render_replace_secret_emits_query_and_path_locations(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -1494,7 +1503,10 @@ def test_render_emits_postgres_listeners_with_env_refs(
     ]
     cfg = yaml.safe_load(render_proxy_yaml(secrets))
     listeners = cfg["postgres"]
-    assert [l["name"] for l in listeners] == ["analytics_pg", "database_url"]
+    assert [listener["name"] for listener in listeners] == [
+        "analytics_pg",
+        "database_url",
+    ]
     assert listeners[0]["listen"] == "0.0.0.0:5432"
     assert listeners[1]["listen"] == "0.0.0.0:5433"
     # upstream.dsn uses the secret_ref directly so iron-proxy can resolve it
diff --git a/services/iron-proxy/iron-proxy.yaml b/services/iron-proxy/iron-proxy.yaml
index 00a8eb382..1de368fb4 100644
--- a/services/iron-proxy/iron-proxy.yaml
+++ b/services/iron-proxy/iron-proxy.yaml
@@ -66,6 +66,7 @@ transforms:
         - "api-access-key"
         - "api-signature"
         - "api-timestamp"
+        - "project-access-token"
         - "fx-access-key"
         - "fx-access-sign"
         - "fx-access-timestamp"