​
StackNet Proxy

Geoff acts as a proxy between users and the StackNet network. The proxy handles authentication, request forwarding, and session management across two architectural layers.

​
Edge Layer (Middleware)

proxy.ts is a Next.js edge middleware that runs on every request:
  • Checks for stackauth_jwt cookie or Authorization: Bearer header
  • Public routes (auth, sandbox previews, OG images, media proxies, API key routes) pass through
  • Unauthenticated API requests get a JSON 401 response
  • Unauthenticated page navigations redirect to the connect page

​
Server Layer

The server-side proxy (lib/stacknet-proxy.ts) handles the heavy lifting:

​
JWT Re-signing

Geoff-issued JWTs (signed with AUTH_SECRET) are decoded and re-signed with STACKNET_JWT_SECRET (HMAC-SHA256) so StackNet recognizes the user’s global_id. Both a stackauth_jwt cookie and Authorization: Bearer header are emitted.

​
Identity Resolution

Verifies JWT signature and expiry, extracts global_id (with sub fallback). Used by all user-scoped proxy routes.

​
Request Forwarding

The canonical forwardToStackNet() function handles:
  • Method-conditional body sourcing (buffer/stream/none)
  • Query string forwarding
  • SSE/streamed response passthrough (unbuffered)
  • Real status and content-type reconstruction
  • Error passthrough (throw to 502 vs upstream error)

​
Session Credit Pool

Per-process in-memory cache of StackNet capability tokens (/cpx/session/open). Tokens let /v1/chat/completions calls skip the per-request budget sweep (~636ms savings per call). Tokens have a 5-hour TTL with eviction at 4h45m.

​
Flow