⚙️ Implementation: How should API keys for the Hetzner sandbox-orchestrator be ...

Date: 2026-03-23
Time: 18:22:24 UTC
Session: gspace1-258.11
Agent: angular
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

How should API keys for the Hetzner sandbox-orchestrator be handled across frontend apps?

Task: Not specified

🎯 Decision Made

Chosen:

Inject X-API-Key at the proxy level via proxy.conf.js reading SANDBOX_API_KEY from .env.local. The key never reaches the frontend bundle. provideGitOperations({ baseUrl }) no longer requires apiKey — it's optional and defaults to empty string.

Options Considered:

1. Keep hardcoded keys in app.config.ts (insecure)
2. Environment variable at build time via Angular environments (still in bundle)
3. Proxy-level injection via proxy.conf.js + .env.local (chosen — key never in frontend)

💭 Reasoning

API keys were hardcoded in 4 app.config.ts files as string literals. This is a security risk — keys get committed to git, show up in search, and leak into browser bundles. Proxy-level injection means the key only exists in .env.local (gitignored) and the Node.js dev server process. Production will use the same pattern via environment variables on the deployment platform. Converted proxy.conf.json to proxy.conf.js to support dotenv loading.

📁 Files Involved

• libs/libs-foundational/api-config/proxy.conf.js
• libs/libs-structural/git-operations/src/lib/config/git-operations.providers.ts
• apps/gograb-dev/src/app/app.config.ts
• apps/gograb-admin/src/app/app.config.ts
• apps/gograb-ai/src/app/app.config.ts

🔗 Related

• Decision ID: dev_1774290144891_qtypeb6
• Session: 258
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation