Work Done
Inspected mono apps/vxdata-api/src/vxdata/api/{auth,app}.py and tests/test_auth.py. Remove the empty-string key from the principal config tokens map, preserve real tokens, and restart all API replicas because principals load once at startup. API_PRINCIPALS_FILE takes precedence over API_PRINCIPALS. Missing credentials then return 401 on protected routes; / and /health remain open. No Kubernetes secrets inspected, deployment changed, or tests executed.
Lessons Learned: Pitfalls
Empty grants still authenticate an anonymous principal; remove the entry instead. Removing all tokens prevents startup.
Lessons Learned: Improvements
Before rollout, identify callers logged as token:anonymous and give them suitable nonempty tokens.