Skip to content

Require generated clients to forward the user JWT #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jasonzbao merged 2 commits into from
Sep 24, 2026
+13 −1
Merged

Require generated clients to forward the user JWT #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
54d40c3
docs(skills): require generated clients to forward the user JWT
rishikesh-major Sep 24, 2026
2a9ce5b
docs(skills): do not excuse hand-rolled resource clients
rishikesh-major Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion plugins/major-build/skills/app-builder/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,17 @@ Two playbooks — use the relevant one before you start:

## Recurring work

Apps no longer carry their own crons. For recurring work against an app's API, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node.
Apps no longer carry their own crons. `cron.json` is not read. For recurring work against an app's API, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node.

## Calling go-api from app code

Do not construct `PostgresResourceClient`, `SlackResourceClient`, `createProxyFetch`, or any other resource client by hand. Import the generated client in `clients/`. It already copies the incoming `x-major-user-jwt`.

A resource call to go-api without `x-major-user-jwt` will be rejected. A hand-rolled client that only sets `MAJOR_JWT_TOKEN` fails, including from a webhook or a workflow `app_call`.

A webhook route and a workflow `app_call` are real requests. Ingress has already set `x-major-user-jwt`. `headers()` works there. Do not drop `getHeaders` so those routes can run.

`MAJOR_JWT_TOKEN` alone is only for the runner and for code that is not inside a request. `current-build` and the error reporter keep using it.

## LLM calls from app code

Expand Down
2 changes: 2 additions & 0 deletions plugins/major-build/skills/using-connectors/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ description: Use for ANY operation against a connected resource or connector —

The organization's connectors are _resources_ — external services (databases, APIs, storage, etc.) the agent and its apps reach through Major's secure clients and MCP tools. Every connector is used the same way: find the resource, read its context docs, then follow that connector's reference in this skill.

App code imports the generated client in `clients/`. Do not construct a client with only `majorJwtToken`. A resource call to go-api without `x-major-user-jwt` will be rejected. A webhook route and a workflow `app_call` already have that header.

## Step 1: List available resources

Call `mcp__resources__list_resources` to get the resources you have access to, with their `resourceId`, type, and `subtype`.
Expand Down
Loading