mirror of
https://github.com/unshackle-dl/unshackle.git
synced 2026-10-24 00:32:18 +02:00
api-only/remote-only serve now authenticates every serve.users key (str-coerced), not just api_secret, so per-user service allowlists apply. RemoteClient tries X-Secret-Key then X-Api-Key on 401 (sticky winner); remote_services.auth_headers prepends extra header names to the defaults.