AWS workload identity
Tunnel clients can now authenticate to the production control plane with an AWS role, including ECS task credentials, instead of a static OpenAI API key. The client obtains a short-lived AWS STS assertion, exchanges it for an OpenAI access token, caches that token in memory, and refreshes it before expiry.
To opt in, register the AWS identity provider with OpenAI and map the role to a project service account with tunnel read and use access. Set both CONTROL_PLANE_AWS_IDENTITY_PROVIDER_ID and CONTROL_PLANE_AWS_SERVICE_ACCOUNT_ID, configure the AWS region and credentials, and leave static API key settings—including the OPENAI_API_KEY fallback—unset. The role requires sts:GetWebIdentityToken for audience https://api.openai.com/v1. Equivalent CLI flags and YAML settings are available. See the configuration guide.
Existing API-key deployments can retain their current configuration. AWS workload identity requires the production endpoint https://api.openai.com and outbound access to AWS STS and https://auth.openai.com/oauth/token.
AWS identity limitation: the token exchange uses the default HTTP transport. Tunnel-client-specific proxy flags and CA_BUNDLE are not applied to the exchange with auth.openai.com; deployments that depend on those settings should retain API-key authentication until their authentication-network path is supported.
Local HTTP APIs through Harpoon templates
Harpoon templates can now reach a local HTTP API with an explicit per-template allow_loopback_http: true setting. Use a literal loopback IP and a fixed port, such as http://127.0.0.1:23373 or http://[::1]:23373. Hostnames, including localhost, and non-loopback addresses are rejected.
These requests connect directly, ignoring configured and environment HTTP proxies, and never follow redirects. HTTPS remains the default, and the setting does not enable plaintext exact-URL targets or require harpoon.allow_plaintext_http. Upgrade clients before adding this setting; older versions reject the new configuration field. See Harpoon target templates.
Response-upload diagnostics
Opt-in local tracing now records a tunnel.client.upload_attempt child span for each response POST attempt. Records include the attempt number, elapsed time, outcome, and HTTP status when available, making retry time easier to distinguish from request time. Trace export continues to exclude payloads, credentials, headers, and raw errors.
Tracing remains disabled by default. Attempt records require tracing to be enabled and a valid sampled command parent. See local tracing for configuration and a JSONL inspection example.
Build updates
Release binaries and container builds use Go 1.27.3. Dependency license reports and SBOM baselines have been refreshed for the AWS and OpenAI SDK additions.