From 59b45ea0acf430bfe93567d7c266fac72e8065af Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 5 Sep 2026 09:53:09 +0200
Subject: [PATCH] fix: correct the guest JWT minting instructions in the embed
 block

The block said "sign it with the workspace's guest JWT key", but that setting
holds the public verification key. Clarify the keypair relationship (configure
the public key or a JWKS URL in the workspace; sign with the matching private
key), name the accepted algorithms (RS/PS/ES; HS* refused), and keep the
required claims, so an embedder knows how to actually mint the token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../components/apps/editor/AppEditorHeaderDeploy.svelte  | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
index 6ab6568c9e..dafaf6a325 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
@@ -559,9 +559,12 @@
 					account, unlike the plain secret URL above.
 				</div>
 				<div class="text-xs text-secondary">
-					Sign it with the workspace's guest JWT key (Workspace settings → Guests), carrying
-					<code>email</code>, <code>workspace_id</code> = <code>{opWs}</code>,
-					<code>app_path</code> = <code>{appPath}</code> and <code>exp</code> (at most 24h ahead).
+					Set the <b>public</b> half of your signing keypair as the workspace's guest JWT key
+					(Workspace settings → Guests) — a PEM public key or a JWKS URL. In your backend, sign each
+					token with the matching <b>private</b> key using RS256/384/512, PS256/384/512 or ES256/384
+					(symmetric HS* is refused), carrying <code>email</code>,
+					<code>workspace_id</code> = <code>{opWs}</code>, <code>app_path</code> =
+					<code>{appPath}</code> and <code>exp</code> (at most 24h ahead).
 				</div>
 				<ClipboardPanel
 					content={toEmbedSnippet(`${guestJwtBase}/guest.YOUR_GUEST_JWT`)}