Require MFA only for organization key management

[RhysSullivan]

Require a session-bound authenticator check only for listing, creating, and revoking organization API keys in the cloud console. Personal keys remain available on the same page. Issued organization keys retain their existing admin API access, including the email-filtered connections lookup.

The existing role checks, bearer authentication, OAuth callbacks, MCP access, workspace settings, and billing flows remain unchanged. Verification expires after 15 minutes and has a manual lock control.

Validation: 504 cloud tests, targeted MFA/browser/API/OAuth/MCP scenarios, type checks, formatting, and lint pass. The full repository test run fails in an unchanged OpenAPI fixture (packages/plugins/openapi/src/testing.test.ts:29, expected 401, received 404).

Regression tests are in #2117.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	d695467	Sep 24 2026, 08:19 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	d695467	Commit Preview URL Branch Preview URL	Sep 24 2026, 08:18 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2116

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2116

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2116

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2116

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2116

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2116

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2116

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2116

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2116

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2116

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2116

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2116

executor

npm i https://pkg.pr.new/executor@2116

commit: d695467