Add debug logging to WASM client Authorization header

- Secrets are now added to ApiKeyStore on supervisor initialization
- Removed duplicate authentication logic in verify_api_key
- Single source of truth: all authentication goes through ApiKeyStore
- Admin/user/register secrets are treated as API keys with appropriate scopes
- Simplified auth_verify - no special case handling needed

client/src/wasm.rs

@@ -711,8 +711,13 @@ impl WasmSupervisorClient {
         
         // Add Authorization header if secret is present
         if let Some(secret) = &self.secret {
-            headers.set("Authorization", &format!("Bearer {}", secret))
+            let auth_value = format!("Bearer {}", secret);
+            web_sys::console::log_1(&format!("🔐 WASM Client: Setting Authorization header: Bearer {}...", &secret[..secret.len().min(8)]).into());
+            headers.set("Authorization", &auth_value)
                 .map_err(|e| WasmClientError::JavaScript(format!("{:?}", e)))?;
+            web_sys::console::log_1(&"✅ WASM Client: Authorization header set successfully".into());
+        } else {
+            web_sys::console::log_1(&"⚠️ WASM Client: NO SECRET - Authorization header NOT set".into());
         }
 
         // Create request init

core/src/openrpc.rs

@@ -964,34 +964,7 @@ impl SupervisorRpcServer for Arc<Mutex<Supervisor>> {
         let key = get_current_api_key()
             .ok_or_else(|| ErrorObject::owned(-32602, "Missing Authorization header", None::<()>))?;
         
-        // Check if it's an admin secret
+        // verify_api_key now checks secrets first, then API keys
-        if supervisor.has_admin_secret(&key) {
-            return Ok(crate::auth::AuthVerifyResponse {
-                valid: true,
-                name: "Admin Secret".to_string(),
-                scope: "admin".to_string(),
-            });
-        }
-        
-        // Check if it's a user secret
-        if supervisor.has_user_secret(&key) {
-            return Ok(crate::auth::AuthVerifyResponse {
-                valid: true,
-                name: "User Secret".to_string(),
-                scope: "user".to_string(),
-            });
-        }
-        
-        // Check if it's a register secret
-        if supervisor.has_register_secret(&key) {
-            return Ok(crate::auth::AuthVerifyResponse {
-                valid: true,
-                name: "Register Secret".to_string(),
-                scope: "register".to_string(),
-            });
-        }
-        
-        // Check if it's an API key
         match supervisor.verify_api_key(&key).await {
             Some(api_key) => {
                 Ok(crate::auth::AuthVerifyResponse {

core/src/supervisor.rs

@@ -238,6 +238,36 @@ impl SupervisorBuilder {
                 reason: format!("Invalid Redis URL: {}", e),
             })?;
 
+        // Create API key store and add secrets as API keys
+        let mut api_key_store = crate::auth::ApiKeyStore::new();
+        
+        // Add admin secrets as API keys
+        for secret in &self.admin_secrets {
+            api_key_store.add_key(crate::auth::ApiKey::with_key(
+                secret.clone(),
+                "Admin Secret".to_string(),
+                crate::auth::ApiKeyScope::Admin,
+            ));
+        }
+        
+        // Add user secrets as API keys
+        for secret in &self.user_secrets {
+            api_key_store.add_key(crate::auth::ApiKey::with_key(
+                secret.clone(),
+                "User Secret".to_string(),
+                crate::auth::ApiKeyScope::User,
+            ));
+        }
+        
+        // Add register secrets as API keys
+        for secret in &self.register_secrets {
+            api_key_store.add_key(crate::auth::ApiKey::with_key(
+                secret.clone(),
+                "Register Secret".to_string(),
+                crate::auth::ApiKeyScope::Registrar,
+            ));
+        }
+
         Ok(Supervisor {
             client: self.client_builder.build().await.unwrap(),
             runners: self.runners,
@@ -247,7 +277,7 @@ impl SupervisorBuilder {
             admin_secrets: self.admin_secrets,
             user_secrets: self.user_secrets,
             register_secrets: self.register_secrets,
-            api_keys: Arc::new(Mutex::new(crate::auth::ApiKeyStore::new())),
+            api_keys: Arc::new(Mutex::new(api_key_store)),
             services: crate::services::Services::new(),
         })
     }