{"version":"2.1.251","anchor":"sessions-authenticated-through-a-gateway-attach-a-pinned-ide","canonical_anchor":"sessions-authenticated-through-a-gateway-attach-a-pinned-ide","heading":"Sessions authenticated through a gateway attach a pinned identity","tier":"internal","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/sessions-authenticated-through-a-gateway-attach-a-pinned-ide","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Sessions authenticated through a gateway attach a pinned identity\n\nGateway-authenticated sessions now attach a pinned identity tying them to one gateway origin.\n\n**What**\n\nAccounts that authenticate through a gateway token now send a consent identity and a pinned fingerprint alongside the usual authorization header, tying the session to one specific gateway origin. The identity is built from a fixed `gateway:` tag plus the gateway's https origin, and the account identifier is hashed with SHA-256 once it passes a length threshold rather than being sent as-is.\n\n**Details**\n\n- only applies when gateway token auth is in use; API key and OAuth sessions keep their existing consent identity path\n- the hashing means the raw account identifier does not travel in the header\n\n**Evidence**\n\n`gateway:`, `organizationUuid: `${pe}${o}#${t}``\n\n- Area: Auth\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}