What
Accounts that authenticate through a gateway token now send a consent identity and a pinned fingerprint alongside the usual authorization header, tying the session to one specific gateway origin. The identity is built from a fixed gateway: tag plus the gateway's https origin, and the account identifier is hashed with SHA-256 once it passes a length threshold rather than being sent as-is.
Details
- only applies when gateway token auth is in use; API key and OAuth sessions keep their existing consent identity path
- the hashing means the raw account identifier does not travel in the header
Evidence
gateway:, organizationUuid: ${pe}${o}#${t}``
Strings lifted out of the shipped bundle, so the claim above can be checked against them.