Architecture
- spacesheep.dev — viewer UI, dashboard, auth (Google OAuth or email + password)
- mcp.spacesheep.dev — MCP control plane (Streamable HTTP, API key or OAuth)
User content is served on a separate origin (spacesheep.app) so it cannot access spacesheep.dev cookies, storage, or DOM. The iframe sandbox attribute provides defense in depth.
Security
- Separate origin isolation (spacesheep.app vs spacesheep.dev)
- Google OAuth or email + password sign-in (PBKDF2-hashed, email-verified)
- Per-space per-email permissions, checked on every request
- One-time auth tickets (KV, 60s TTL)
- Signed session cookies (HMAC-SHA256, HttpOnly, Secure)
- Private object storage (no public URLs)
- Sandboxed iframe (defense in depth)
- API key or OAuth 2.0 (Authorization Code + PKCE) on MCP endpoint
- Worker secrets: isolated API, fetch interception, response redaction
Was this page helpful?