Static — credentials/static

# Static credentials selected only after canonical environment admission.
# All names and endpoints are synthetic. Secrets are resolved natively, and
# managed headers are injected after removing the inbound shared token.
server: {addr: ":8080", max_body_bytes: 20971520, max_inflight_requests: 16}
credentials:
  preview_key:
    kind: static
    allowed_origins: [https://preview.example.org]
    headers:
      X-Sample-Key: {secret_ref: {provider: env, name: SAMPLE_PREVIEW_KEY, refresh: 1m}}
  production_key:
    kind: static
    allowed_origins: [https://api.example.net]
    headers:
      X-Sample-Key: {secret_ref: {provider: aws_secrets_manager, name: sample/production, json_field: api_key, selection: exact, refresh: 1m}}
routing:
  profiles: {sample: {account_id: "000000000000", credential_mode: sample}}
  environments:
    preview: {aliases: [staging], profiles: [sample], accounts: ["000000000000"], destination_prefix: preview, backend_host: preview.example.org}
    production: {profiles: [sample], accounts: ["000000000000"], destination_prefix: production, backend_host: api.example.net}
flows:
  managed_proxy:
    nodes:
      - {id: in, type: http_trigger, path: "/proxy/managed/{rest...}", methods: [GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS]}
      - {id: body, type: read_body, allow_empty: true, max_bytes: 20971520}
      - {id: auth, type: auth, scheme: exact, secret_ref: {provider: env, name: SAMPLE_INGRESS_TOKEN}, signature_header: X-Auth}
      - {id: env, type: envelope, body_format: raw}
      - {id: route, type: route, profile: sample, candidates: [{source: header, path: X-Env}]}
      - id: up
        type: http_request
        upstream: {profile: sample, environment_variable: route, path: "/{rest}"}
        credential: {routing_profile: sample, environment_variable: route, environment_profiles: {preview: preview_key, production: production_key}}
        forward_method: true
        forward_query: true
        query_mode: last
        remove_headers: [X-Auth, X-Env]
        body_methods: [POST, PUT, PATCH, DELETE]
        max_response_bytes: 20971520
      - {id: reply, type: respond, passthrough: true}
    edges: [in>body, body>auth, auth>env, env>route, route>up, up>reply]