Struct AccessKeyStrategy 

pub struct AccessKeyStrategy<S = NoStore> { /* private fields */ }

An AuthStrategy that uses a static access key to authenticate against a specific workspace.

The strategy is bound to a workspace CRN at construction. The region is derived from the CRN — there is no separate region argument — so a caller can’t accidentally point the strategy at one region while the CRN says another.

The first call to get_token authenticates with the server. Subsequent calls return the cached token until it expires, at which point re-authentication happens automatically. Every returned token is checked against the CRN; post-auth verification can fail in two ways:

• AuthError::WorkspaceMismatch — the JWT decoded cleanly but its workspace claim doesn’t match the CRN’s workspace ID.
• AuthError::InvalidToken — the JWT is malformed or missing the workspace claim entirely, so verification can’t run.

Either outcome is preferred over silently letting the caller operate on a different workspace than they specified.

When constructed via AccessKeyStrategyBuilder::with_token_store, the strategy also persists tokens through an external TokenStore so that short-lived strategy instances (e.g. one per Edge Function request) can share a cache and avoid re-authenticating every cold start.

Example

use stack_auth::{AccessKey, AccessKeyStrategy};
use cts_common::Crn;

let crn: Crn = "crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY".parse().unwrap();
let key: AccessKey = "CSAKmyKeyId.myKeySecret".parse().unwrap();
let strategy = AccessKeyStrategy::new(crn, key).unwrap();

Implementations

impl AccessKeyStrategy

pub fn new(workspace_crn: Crn, access_key: AccessKey) -> Result<Self, AuthError>

Create a new AccessKeyStrategy for the given workspace CRN and access key. The auth endpoint is resolved automatically via service discovery using the region encoded in the CRN.

The CS_CTS_HOST environment variable, if set and non-empty, overrides service discovery — useful for pointing the strategy at a staging CTS or a local mock without changing the CRN.

A CRN with a service_name component (e.g. crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY:zerokms) is accepted; the service_name is ignored. Only the region and workspace ID are load-bearing for this strategy.

pub fn builder( workspace_crn: Crn, access_key: AccessKey, ) -> AccessKeyStrategyBuilder

Return a builder for configuring an AccessKeyStrategy before construction.

Example

use stack_auth::{AccessKey, AccessKeyStrategy};
use cts_common::Crn;

let crn: Crn = "crn:ap-southeast-2.aws:ZVATKW3VHMFG27DY".parse().unwrap();
let key: AccessKey = "CSAKmyKeyId.myKeySecret".parse().unwrap();
let strategy = AccessKeyStrategy::builder(crn, key)
    .audience("my-audience")
    .build()
    .unwrap();

Trait Implementations

impl<S: TokenStore> AuthStrategy for &AccessKeyStrategy<S>

async fn get_token(self) -> Result<ServiceToken, AuthError>

Retrieve a valid access token, refreshing or re-authenticating as needed.