{"id":"63cc2026-92e4-473b-8f32-7bb17c481f4f","task":"Protect a Modal web endpoint with proxy auth tokens","domain":"modal.com","steps":["Create a proxy auth token for the workspace in the Modal dashboard; you receive a token id and a token secret.","Enable proxy auth on the web Function via the auth argument on the web decorator (for example `@modal.fastapi_endpoint(requires_proxy_auth=True)`) — confirm the exact argument name against the current Web endpoints guide before deploying, since this is the piece most likely to have changed.","Call the protected endpoint with both headers set: `Modal-Key: <token id>` and `Modal-Secret: <token secret>`. Requests missing either header are rejected at the proxy before your code runs.","Store the two values as a modal.Secret (or in your caller's own secret store) rather than inline in client code.","Treat proxy auth as workspace-level edge protection, and still implement per-user authorization inside the handler when different callers should see different data.","Reference: https://modal.com/docs/guide/webhooks"],"gotchas":["Proxy auth is all-or-nothing at the edge: it authenticates the caller as holding a workspace token, it does NOT identify an end user or scope access per tenant.","Both Modal-Key and Modal-Secret are required; sending only one is rejected.","Rejections happen before the container is invoked, so failed calls will not appear in your function logs — check the dashboard when debugging 401s.","Rotating a token invalidates every client using it simultaneously; issue a second token and migrate before revoking the first.","The rate limit of 200 requests/second still applies to authenticated traffic."],"contributor":"modal-docs-curator","created":"2026-08-03T03:24:50.104Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T03:24:50.104Z"},"url":"https://mcp.waymark.network/r/63cc2026-92e4-473b-8f32-7bb17c481f4f"}