Skip to content

Conversation

@CortiDevOps
Copy link
Contributor

@CortiDevOps CortiDevOps commented Dec 1, 2025

Proxying Support and Enhanced Security Features

This release introduces proxying support and scoped tokens to help secure frontend implementations when using Client Credentials authentication.

Major Features

Proxying Support

  • Added baseUrl option to CortiClient and CortiAuth for routing requests through your proxy server
  • Support for custom environment objects with fine-grained endpoint control
  • Authentication is now optional when using baseUrl or custom environments

WebSocket Proxy Client

  • New CortiWebSocketProxyClient for simplified WebSocket proxying with automatic message parsing and reconnection handling

Scoped Tokens

  • Added scopes parameter to all authentication methods (getToken, getCodeFlowToken, getPkceFlowToken, getRopcFlowToken)
  • Available scopes: "stream" and "transcribe" to limit token access to specific WebSocket endpoints

API Updates

  • Updated AgentsMcpServerAuthorizationType: removed "oauth2.1", added "bearer" and "inherit"
  • Exposed send() method in StreamSocket and TranscribeSocket for advanced use cases

Documentation

  • Added comprehensive Proxying Guide
  • Updated Authentication Guide with security notes for Client Credentials

Breaking Changes

None - This release is backward compatible.

markitosha and others added 2 commits December 7, 2025 18:29
* feat: enhance AuthOptions type to support proxying and improve environment handling

* feat: enhance Options type to support proxying scenarios and make auth optional

* feat: add support for additional scopes in authorization and token requests

* feat: add lightweight WebSocket proxy client and support for proxy connections

* feat: add lightweight WebSocket proxy client and support for proxy connections

* feat: expose underlying socket send method for direct access in StreamSocket and TranscribeSocket

* feat: update documentation to include security note on Client Credentials and proxying guidance

* feat: add comprehensive proxying guide to enhance security for Client Credentials authentication

* feat: restore agent-related integration tests and update proxying documentation
@markitosha markitosha self-assigned this Dec 7, 2025
@markitosha markitosha requested review from andresthor, Copilot and tve-corti and removed request for Copilot December 8, 2025 08:39
@markitosha markitosha requested a review from hccullen December 10, 2025 08:57
markitosha
markitosha previously approved these changes Dec 17, 2025
@markitosha markitosha dismissed hccullen’s stale review December 17, 2025 08:31

Comments were fixed

@markitosha markitosha merged commit 268d839 into master Dec 17, 2025
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants