[dotsdl]

Fixes #519.

Summary

alchemiscale api and alchemiscale compute api discarded the JWT_SECRET_KEY / --jwt-secret they were given: the option's generate_secret_key callback ignored value and always returned a freshly generated key, which then overrode the environment settings via dependency_overrides. Every API process therefore signed tokens with its own private key, so tokens failed with 401 on other replicas and were invalidated on every restart.

Changes

• alchemiscale/cli.py: the callback now passes through a supplied secret and only generates a random key when none is given. When it does generate one, it prints a warning to stderr, so a deployment missing the key no longer fails silently. Removed the stale "CONSIDER GENERATING…" comments in both api commands, since this now implements that behaviour. Updated the --jwt-secret help text.
• alchemiscale/tests/integration/test_cli.py: tests that a secret supplied by option or env var is used unchanged with no warning, and that with no secret a warning is printed and each invocation gets a different random key.
• docs/deployment.rst: note that JWT_SECRET_KEY must be set and shared across all API processes.
• news/issue-519.rst: changelog fragment.

Testing

I couldn't run the full test suite here because the conda-only dependencies (openff) weren't available. Instead, I ran the jwt_params callback through CliRunner with those imports stubbed out:

• --jwt-secret abc → abc
• JWT_SECRET_KEY=fromenv → fromenv
• unset → warning on stderr plus a different random key on each run

black --check passes on the changed files. CI needs to run the new tests in test_cli.py.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.99%. Comparing base (91e4dac) to head (28d376b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #520      +/-   ##
==========================================
+ Coverage   80.94%   80.99%   +0.05%     
==========================================
  Files          31       31              
  Lines        4932     4935       +3     
==========================================
+ Hits         3992     3997       +5     
+ Misses        940      938       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.