igroff / bottle Goto Github PK

It seems right now that bottle calls subscribers with no identity. We can work around this today by using private network proxies, but in the future, I hear those are going away. While we could make totally unauthenticated ("public") endpoints for bottle to call, that seems like an undesirable exposure. If the endpoints were discovered, a malicious actor could manipulate our systems.

Proposal: Add an optional auth token that it can get from a secrets store to pass as the auth bearer token in its requests.