Internal tools gated on Hoody login, no SSO project

An engineer on the data team ships a small exec endpoint that answers a question every internal script keeps asking: which customers are on the old pricing plan. It works. IT's only condition is that strangers can't call it.

IT adds a hoody-identity group to the container's permissions, sets an audience, lists the allowed user IDs in users, and sets default: deny. The proxy verifies the ED25519 claim Hoody mints at login, rejects everything else, and injects X-Hoody-Identity-Sub and X-Hoody-Identity-Username into the request after stripping any client-supplied versions. The script reads the username from a header and trusts it. For a browser-facing app, the same claim goes through a proxy hook instead.

No OAuth dance, no session store, no SSO integration ticket with a six-week queue. One permission entry, zero lines of auth code.

The app never sees a credential. It sees a verified header.