agentsclimarketplace

Igrantio backend proxy

Skill L3-iGrant/skills/ows/igrantio-backend-proxy

Agent Skills for EUDI Wallet and European Business Wallet integrations: credential issuance (OpenID4VCI), verification (OpenID4VP + DCQL), DC API and consent management on the iGrant.io Organisation Wallet Suite

Install
npx -y skills add L3-iGrant/skills --skill igrantio-backend-proxy

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 22 days oldThe repository was created 22 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Composable building block: a tenant-aware reverse proxy that hides per-organisation iGrant.io OWS API keys from the browser. Resolves a tenant slug to its API key, allow-lists the OWS paths the frontend may reach, injects Authorization "ApiKey <key>", and forwards to OWS. Use to add API-key hiding + per-tenant key management to any Node/TypeScript backend; the OpenID4VCI issuer and OpenID4VP verifier backends compose it.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.6 KB, as published. Nobody here has run it

iGrant.io backend proxy (API-key hiding, per-tenant)

When to use

Whenever the browser must call OWS but must not hold the API key - which is always. This is the "manages API key for a specific tenant organisation" piece. Compose it into an issuer or verifier backend (see igrantio-issuer-backend / igrantio-verifier-backend) or mount it in an existing Express app.

Before you build: run the integrator intake in igrantio-ows-overview - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each.

What it does

GET|POST|PUT ${proxyPrefix}/{tenant}/{owsPath...}:

  1. resolves {tenant} → OWS API key via a TenantStore (env or pluggable),
  2. rejects any path not on the caller-supplied allow-list (least privilege, 404),
  3. sets Authorization: ApiKey <key> and forwards to OWS,
  4. streams the response back, stripping hop-by-hop headers.

The browser targets ${proxyPrefix}/{tenant} as its base URL with no key.

Reference

./references:

  • proxy.ts - proxyRouter(store, permittedPrefixes) Express router.
  • tenants.ts - TenantStore interface + EnvTenantStore / MapTenantStore.
  • config.ts - OWS base URL (OWS_ENV demo|staging, default demo) + timeout.

Usage

import express from "express";
import { proxyRouter } from "./proxy";
import { EnvTenantStore } from "./tenants";
import { config } from "./config";

const ISSUER = [
  "v2/config/digital-wallet/openid/sdjwt/credential/issue",
  "v2/config/digital-wallet/openid/sdjwt/credential/history",
];
app.use(config.proxyPrefix, proxyRouter(new EnvTenantStore(), ISSUER));

Per-tenant key management

  • EnvTenantStore reads OWS_TENANT_<SLUG>_API_KEY.
  • Swap in a DB / secret-manager TenantStore (async getApiKey) for many organisations; rotate by updating the store - no frontend change.

Clean-code notes

  • The allow-list is a parameter, so issuer/verifier scope the proxy to just their endpoints (least privilege) with one array.
  • OWS base URL lives only in config.ts; the proxy is transport, not policy.

Validation / done criteria

  • A request to a non-allow-listed path returns 404; the tenant key never appears in any response or in the browser.
  • An unknown tenant returns 404.

Documentation & workflows

When anything is unclear, consult the iGrant.io documentation before guessing:

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.