Interop: JS SDKs (v10) send auth as query param — ingest only accepts X-Sentry-Auth header (401) #327

What

POST /api/{project_id}/envelope/ returns 401 when the Sentry key is supplied as a URL query parameter, and 200 only when auth arrives via the X-Sentry-Auth header. Sentry JS-family SDKs (@sentry/node, @sentry/bun, @sentry/browser; verified with @sentry/bun 10.75.2) send auth as a query string — ?sentry_key=...&sentry_version=7 (see _encodedAuth() / getEnvelopeEndpointWithUrlEncodedAuth() in @sentry/core api.js) — and set no auth header at all. Result: every event from a stock JS SDK is rejected.

Evidence (2026-09-22, live on trapfall.ajianaz.dev v0.3.0, identical envelope payloads)

Cross-check with installed SDK source: @sentry/core/build/cjs/api.js builds the ingest URL with query-encoded auth; the Bun fetch transport sends only Content-Type. The Rust SDK uses the X-Sentry-Auth header, which is why the rungu/cira integrations work today.

Impact

• Stock JS/TS SDK consumers (the largest Sentry SDK family) cannot ingest at all: silent event loss (SDK logs a transport error, dashboard stays empty).
• Blocks the gatehouse (Bun) integration — currently bridged per-app via tunnel + transportOptions.headers (works, but every JS consumer must re-implement the bridge).

Suggested fix

In the ingest auth check, accept the Sentry key from either the X-Sentry-Auth header (current behavior) or the sentry_key query parameter (JS SDK style): key = header_value.or_else(|| query_param("sentry_key")). Keep the 401 for missing/unknown keys either way.