Environment and auth

Your application server should authenticate the user, determine their organization, and attach the runner credential. The browser should supply only the task-specific request data.

Core environment values

These values stay on the server:

export KESTREL_RUNNER_SERVICE_URL=http://127.0.0.1:4010
export KESTREL_RUNNER_SERVICE_TOKEN=dev-secret

Do not expose the token through browser-readable environment variables.

Resolve user context in one place

export async function resolveWorkspaceCopilotContext() {
  return {
    actor: {
      actorId: "user-123",
      actorType: "end_user" as const,
      displayName: "Taylor Example",
    },
    tenantId: "acme",
  };
}

Keeping this logic in one server module makes authentication behavior easier to review and change safely.

Correlation headers

The Next.js route helpers read these headers from the inbound request:

• x-request-id
• x-correlation-id
• user-agent
• x-forwarded-for

If either id is missing, the helper generates it and returns Kestrel correlation ids in the response headers. Preserve them so a support report can be matched to the corresponding runner activity.

Where each value comes from

Check the server-side setup

• the application reads credentials and caller identity in one server module
• actor and tenant values come from authenticated application data
• /api/copilot/run and /api/copilot/stream preserve request correlation end to end

If identity is missing or incorrect

Check the server route that reads the authenticated session and creates the Kestrel context. Do not accept actorId or tenantId directly from browser input.

Prepare for production

• Connect to a runner service
• Integrating with Next.js
• FAQ