Flow
Server-side proxy
Browser -> POST /api/product-feature -> validate product user and tenant -> map feature_key to harness_id -> call HarnessRouter with HR_API_KEY -> return product-shaped stream or JSON
Why
- Keeps the HarnessRouter API key out of the browser.
- Lets the product enforce user and tenant ownership.
- Allows the product to sanitize progress events and generated previews.
- Preserves one stable UI contract even if the configured agent changes.
Open standard
Putting your backend between the browser and HarnessRouter places it in the Client role of UHP's architecture — the application that wants work done, which the spec itself says can be a product backend. See roles in the UHP Architecture chapter.
Create API Key
Ready to run this against a live workspace? Keys take under a minute.

