Function validateWorkOSApiKey

server/src/middleware/auth.ts:222–245

(req: Request)

 * Returns the validated API key info or null if invalid
 */
export async function validateWorkOSApiKey(req: Request): Promise<ValidatedApiKey | null> {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) return null;

  const token = authHeader.slice(7); // Remove 'Bearer ' prefix

  // WorkOS API keys use 'wos_api_key_' (legacy) or 'sk_' (current) prefix
  if (!isWorkOSApiKeyFormat(token)) return null;

  try {
    const result = await workos.apiKeys.createValidation({ value: token });
    if (!result.apiKey) return null;

    return {
      id: result.apiKey.id,
      organizationId: result.apiKey.owner.id,
      name: result.apiKey.name,
      permissions: result.apiKey.permissions,
    };
  } catch (error) {
    logger.debug({ err: error }, 'API key validation failed');
    return null;
  }
}

/**
 * Check if validated API key has a specific permission