> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# External authorization check for forward-auth and Envoy ext_authz

> Forward-auth endpoint for an Envoy/nginx ``ext_authz`` filter.

Checks your ``Authorization-PSK`` header and injects ``x-authz-*`` and ``x-auth-method`` identity
headers for the proxy if valid. Bearer-only requests aren't handled here.

Depending on your PSK, one of three things happens:

* **Valid user PSK**: Returns 200 with ``x-authz-*`` and ``x-auth-method`` identity headers injected.
* **Invalid PSK or the shared general PSK**: Returns 403. The shared general PSK carries no real identity,
so the API blocks it to prevent passing a fixed ``psk`` user to upstream services.
* **No PSK**: Returns 200 with no ``x-authz-*`` identity headers. JWT takes over.



## OpenAPI

````yaml post /api/identity/ext-authz
openapi: 3.1.0
info:
  title: Nx1 AI API
  description: |

    AI API for Nx1 Data Platform Management and Automated Data Tasks.

    Authentication is required via PSK in Authorization header.

    Default PSK is | [ask a friend] |
  version: 0.10.2
servers: []
security: []
paths:
  /api/identity/ext-authz:
    post:
      tags:
        - Identity
      summary: External authorization check for forward-auth and Envoy ext_authz
      description: >-
        Forward-auth endpoint for an Envoy/nginx ``ext_authz`` filter.


        Checks your ``Authorization-PSK`` header and injects ``x-authz-*`` and
        ``x-auth-method`` identity

        headers for the proxy if valid. Bearer-only requests aren't handled
        here.


        Depending on your PSK, one of three things happens:


        * **Valid user PSK**: Returns 200 with ``x-authz-*`` and
        ``x-auth-method`` identity headers injected.

        * **Invalid PSK or the shared general PSK**: Returns 403. The shared
        general PSK carries no real identity,

        so the API blocks it to prevent passing a fixed ``psk`` user to upstream
        services.

        * **No PSK**: Returns 200 with no ``x-authz-*`` identity headers. JWT
        takes over.
      operationId: ext_authz_api_identity_ext_authz_get
      responses:
        '200':
          description: Allowed. The API sets identity headers when a valid PSK is present.
          content:
            application/json:
              schema: {}
        '403':
          description: PSK present but invalid.
      security:
        - APIKeyHeader: []
components:
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: Authorization-PSK

````