Server-side proxy pattern

Flow

Server-side proxy

Browser
  -> POST /api/product-feature
  -> validate product user and tenant
  -> map feature_key to harness_id
  -> call HarnessRouter with HR_API_KEY
  -> return product-shaped stream or JSON

Why

• Keeps the HarnessRouter API key out of the browser.
• Lets the product enforce user and tenant ownership.
• Allows the product to sanitize progress events and generated previews.
• Preserves one stable UI contract even if the configured agent changes.

Open standard
Putting your backend between the browser and HarnessRouter places it in the Client role of UHP's architecture — the application that wants work done, which the spec itself says can be a product backend. See roles in the UHP Architecture chapter.
Create API Key →

Ready to run this against a live workspace? Keys take under a minute.