Ai gateway observability/log token ai gateway - #74647
Open
alex-m-brown wants to merge 3 commits into
Open
Conversation
Replace the raw user id claim with a log token, so the AI gateway can key rate limits and logs per user without ever seeing a user id. Depends on the gateway worker reading the new claim; do not merge before that worker is deployed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
alex-m-brown
force-pushed
the
ai-gateway-observability/log-token-ai-gateway
branch
from
August 14, 2026 15:39
cf1da5a to
c6037b5
Compare
This was referenced Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The access token of the AI gateway had a
user_idclaim that held the rawuser_id. This change removes the claim and puts auser_log_tokenclaim in its place. The gateway can count and group its data for each user, but it neverreceives a user id.
The log token uses the
sentrydestination, because the gateway sends its error reports and spans to Sentry. The dashboard uses the same destination for its own Sentry events. Therefore one log token identifies a user in the data of the dashboard and in the data of the gateway.Links
Testing story
dashboard/test/controllers/ai_gateway_auth_controller_test.rbis a new file of testsDeployment notes
Must merge after AI-Gateway PR: https://github.com/code-dot-org/ai-gateway/pull/47
Do not merge this pull request before these two conditions are true:
ai-gateway-observability/log-token-sentryis merged. That branch addsCdo::UserLogTokenand theuser_log_token_keysconfiguration.user_log_tokenclaim. This change removes theuser_idclaim. A worker that reads onlyuser_idfinds no value.Set
user_log_token_keysin each environment before deployment. If the key is absent, the module makes no token, the claim isnull, and the gateway sees all, users as one user.Privacy and security
The raw user id no longer goes to the AI gateway. It also no longer goes to the systems that receive data from the gateway.