Deployed 5796729 with MkDocs version: 1.6.1

dev/rest-api/authentication/index.html

@@ -2721,7 +2721,7 @@
 <p>The header and config are identical between modes, but the code that enforces them differs:</p>
 <ul>
 <li>
-<p><strong>API-only server</strong> (<code>--api-only</code>, or <code>--remote-only</code> which forces API-only). An <code>api_key_authentication</code> middleware runs on every request. It lets <code>GET /api/health</code> through unconditionally, then reads <code>X-Secret-Key</code>. An empty header returns the <em>"Secret Key is Empty."</em> body; a header that is not a configured user returns <em>"Secret Key is Invalid."</em>. In this mode the accepted-keys map contains exactly one entry: your <code>api_secret</code> (labelled <code>api_user</code>, with no devices). With <code>--no-key</code>, this middleware is simply not installed and the users map is empty.</p>
+<p><strong>API-only server</strong> (<code>--api-only</code>, or <code>--remote-only</code> which forces API-only). An <code>api_key_authentication</code> middleware runs on every request. It lets <code>GET /api/health</code> through unconditionally, then reads <code>X-Secret-Key</code>. An empty header returns the <em>"Secret Key is Empty."</em> body; a header that is not a configured user returns <em>"Secret Key is Invalid."</em>. In this mode the accepted-keys map holds your <code>api_secret</code> (labelled <code>api_user</code>, with no devices) plus every key under <code>serve.users</code>, so a per-user key authenticates here exactly as it does on the integrated server, and that user's <code>services</code> allowlist applies as usual. With <code>--no-key</code>, this middleware is simply not installed and the users map is empty.</p>
 </li>
 <li>
 <p><strong>Integrated server</strong> (default). A <code>serve_authentication</code> middleware wraps pywidevine's authentication (and pyplayready's for <code>/playready*</code> paths), and the REST routes live in the same application, guarded by the same check. Here the accepted-keys map is your full <code>serve</code> config: <code>api_secret</code> (auto-added with access to all loaded devices) plus every entry under <code>users</code>, each with its declared <code>devices</code> / <code>playready_devices</code>.</p>

reference/configuration/services/index.html

@@ -2110,9 +2110,16 @@ to the normal file-based cookie path (<code>cookies/&lt;SERVICE&gt;.txt</code> o
 </ul>
 <p>Definitions of remote unshackle service servers, used by the <code>--remote</code> mode. Each entry is
 named by you (pick it with <code>--server</code>, or omit that flag when only one is configured) and gives
-the server's <code>url</code> (required), an optional <code>api_key</code> sent as <code>X-Secret-Key</code>, an optional
-<code>server_cdm</code> boolean, and an optional <code>services</code> sub-dict of per-service local overrides such
-as <code>title_map</code>. In <code>--remote</code> mode unshackle turns the server's service list into synthetic CLI
+the server's <code>url</code> (required), an optional <code>api_key</code>, an optional <code>auth_headers</code> list, an
+optional <code>server_cdm</code> boolean, and an optional <code>services</code> sub-dict of per-service local
+overrides such as <code>title_map</code>.</p>
+<p><code>auth_headers</code> lists extra header names to send the API key in, tried before the defaults
+<code>X-Secret-Key</code> and <code>X-Api-Key</code>, which are always appended as fallbacks. unshackle sends the
+first name; if the server answers <code>401</code>, it retries the same request with the next name, and
+keeps the one that works for the rest of the session. Names you list keep your spelling and are
+not repeated in the fallbacks, so <code>auth_headers: ["Authorization", "x-secret-key"]</code> is tried as
+<code>Authorization</code>, <code>x-secret-key</code>, <code>X-Api-Key</code>.</p>
+<p>In <code>--remote</code> mode unshackle turns the server's service list into synthetic CLI
 commands that run against it, falling back to the tags in that <code>services</code> sub-dict when the
 list cannot be fetched. See <a href="../../../dev/rest-api/remote-sessions/">remote sessions</a> for the
 full setup.</p>