#119 fix(tokens): only a plain api key may delegate an assertion scope

Summary

Follow-up to #114, addressing review thread https://github.com/AgentWorkforce/relayauth/pull/114#discussion_r4429643545.

Delegating an assertion scope (through POST /v1/api-keys or POST /v1/tokens/workspace) now requires the caller to be a plain API key that holds the exact literal. Bearer tokens and workspace tokens do not qualify, because their scopes can be assigned within an org. Broker keys are provisioned out of band (bootstrap file or operator insert), so the assertion tests now seed them directly.

Verification

• packages/server npm test: 694/694 pass.
• tsc --noEmit (after turbo build): clean.
• Reverting the credential check fails the new bearer-delegation test.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Agent Relay sessions

• claude session a685ac1e · opened via gh pr create · last active 2026-10-31