iGrant.io backend proxy (API-key hiding, per-tenant)

When to use

Whenever the browser must call OWS but must not hold the API key - which is always. This is the "manages API key for a specific tenant organisation" piece. Compose it into an issuer or verifier backend (see igrantio-issuer-backend / igrantio-verifier-backend) or mount it in an existing Express app.

Before you build: run the integrator intake in igrantio-ows-overview - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each.

What it does

GET|POST|PUT|DELETE ${proxyPrefix}/{tenant}/{owsPath...}:

1. resolves {tenant} → OWS API key via a TenantStore (env or pluggable),
2. rejects any path not on the caller-supplied allow-list (least privilege, 404) - a string rule matches as a path prefix, a RegExp rule against the whole path,
3. sets Authorization: ApiKey <key> and forwards to OWS,
4. streams the response back, stripping hop-by-hop headers.

The browser targets ${proxyPrefix}/{tenant} as its base URL with no key.