The AI Gateway Now Proxies to Connector-Worker
Connector-worker now trusts exactly one caller — the AI gateway — which resolves who you are before forwarding your request, instead of asking twice.
Connector-worker — the new service behind Google account connections and Gmail/Sheets/Calendar actions — has no public address of its own. Like a couple of other backend workers, it's reachable only from inside the platform's own network of services. This release wires it into the one path that's actually supposed to reach it: the AI gateway.
One caller, and only one
The AI gateway (cf-ai-gateway-worker) already does the work of figuring out who's calling before any of its own routes run — whether that's an API key or a signed-in dashboard session. This release adds a private connection from the gateway straight to connector-worker, and routes every connector-related path — connecting a Google account, checking connection status, listing and running actions — through it. Nothing on the gateway-portal dashboard side had to change: it already only ever talks to the gateway, and now the gateway quietly extends that same relationship to cover connectors too.
A design correction, made same-day
The interesting part of this story is what happened right before it. Connector-worker's first version resolved who was calling it by phoning back into the gateway's own "who is this" endpoint — a second identity check, on a second connection, for every request. That turned out to be pointless: the gateway had already done that work before the request ever reached connector-worker. So it was removed. Today, connector-worker trusts exactly one thing: a shared internal key plus the identity the gateway has already resolved and attached to the request. No second lookup, no second connection to maintain, no second place for that trust decision to quietly drift out of sync with the first.
It's a small architectural correction, but the kind that matters — a service that re-checks something its only trusted caller already checked isn't adding security, it's adding a place for the two checks to someday disagree.
What this means in practice
If you're connecting a Google account or running a Gmail/Sheets/Calendar action from a workflow or from the gateway-portal dashboard, this is the path your request now takes — through the gateway, and only the gateway, all the way to connector-worker.