---
title: "2026-09-17 vxData anonymous access switch"
description: "Source-only confirmation of how to disable anonymous vxData API access."
image: "https://docs.virdx.dev/img/virdx-social-card.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.virdx.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 2026-09-17 vxData anonymous access switch

## Work Done

Inspected mono `apps/vxdata-api/src/vxdata/api/{auth,app}.py` and `tests/test_auth.py`. Remove the empty-string key from the principal config `tokens` map, preserve real tokens, and restart all API replicas because principals load once at startup. `API_PRINCIPALS_FILE` takes precedence over `API_PRINCIPALS`. Missing credentials then return 401 on protected routes; `/` and `/health` remain open. No Kubernetes secrets inspected, deployment changed, or tests executed.

## Lessons Learned: Pitfalls

Empty grants still authenticate an anonymous principal; remove the entry instead. Removing all tokens prevents startup.

## Lessons Learned: Improvements

Before rollout, identify callers logged as `token:anonymous` and give them suitable nonempty tokens.

Source: https://docs.virdx.dev/knowledge/inbox/2026-09-17-infrastructure-vxdata-anonymous-access/index.mdx