web: send only Hexclave auth headers to Stack (x-stack-* aliases now get 429)

Merged
LA
24d ago
+9-28

Since about 06:30 UTC on 2026-10-13, Stack answers 429 with an empty body to every server request that carries the legacy x-stack-project-id / x-stack-secret-server-key headers next to the x-hexclave-* ones. The same request with only the x-hexclave-* names answers 200. Verified against production for GET /contact-channels?user_id= and GET /users/{id} (3/3 each way, one request at a time, so this is not volume).

Impact in production:

  • GET /api/teams/invitations went from 0 to ~75% 503 at 06:30 (652 in 70 min). #20041 moved the invitation poll to a direct contact-channels read with both header sets; before it, the SDK path sent only Hexclave names.
  • The Hexclave webhook inbox drain (services/auth/hexclave/serverApi.ts) sends the same aliases, so its reads hit 429 and the inbox stays throttled (865 rows, Sentry CODEROUTER-WEB-25 "stuck").
  • The session revoker and the user PATCH helper send them too.

Fix: drop the x-stack-* request headers from every server and client REST helper. The SDK already sends only the Hexclave names. Response parsing still reads both x-hexclave-* and x-stack-* response headers.

Tests: the two tests that asserted the alias request headers now assert the Hexclave names, and the invitation-code client test asserts that no x-stack-* request header is sent.

Changelog

Fixed: Pending team invitations load again.

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Stops sending legacy x-stack-* auth headers to Stack, which has been answering 429 (empty body) to requests that carry them alongside the x-hexclave-* headers since 2026-10-13. All server and client REST helpers now send only the Hexclave names, matching what the SDK already does; response parsing still reads both header sets.

This restores pending team invitations (which spiked to ~75% 503) and unblocks the Hexclave webhook inbox drain and session revocations, which were also sending the rejected aliases.

Summary by CodeRabbit

  • Bug Fixes
    • Authentication and server requests now send Hexclave-prefixed headers instead of legacy Stack-prefixed aliases. This applies to sign-in, invitation, team, and session-revocation requests.
    • Known-error handling still recognizes both Hexclave and Stack header formats, including when checking whether a session has already been revoked.