Flow
Server-side proxy
Browser -> POST /api/product-feature -> validate product user and tenant -> map feature_key to harness_id -> call HarnessRouter with HR_API_KEY -> return product-shaped stream or JSON
Why
- Keeps the HarnessRouter API key out of the browser.
- Lets the product enforce user and tenant ownership.
- Allows the product to sanitize progress events and generated previews.
- Preserves one stable UI contract even if the configured agent changes.
Open standard
Putting your backend between the browser and HarnessRouter places it in the Client role of UHP's architecture, the application that wants work done, which the spec itself says can be a product backend. See roles in the UHP Architecture chapter.
Create API Key
Ready to run this against a live workspace? Keys take under a minute.

