iGrant.io backend proxy (API-key hiding, per-tenant)

When to use

Whenever the browser must call OWS but must not hold the API key - which is always. This is the "manages API key for a specific tenant organisation" piece. Compose it into an issuer or verifier backend (see igrantio-issuer-backend / igrantio-verifier-backend) or mount it in an existing Express app.

What it does

GET|POST|PUT ${proxyPrefix}/{tenant}/{owsPath...}:

1. resolves {tenant} → OWS API key via a TenantStore (env or pluggable),
2. rejects any path not on the caller-supplied allow-list (least privilege, 404),
3. sets Authorization: ApiKey <key> and forwards to OWS,
4. streams the response back, stripping hop-by-hop headers.

The browser targets ${proxyPrefix}/{tenant} as its base URL with no key.