Well, the software for now is designed for trusted groups of users, so appart from making sure users can't access sessions of others in the same pool, there's not much.

For context, it's sent in every request of claude code and codex (only in http, not websocket) so we don't have to handle anything, the server just rewrites the auth headers of the request, keeping it intact out of that.