[Bug] Dashboard apiCall sends raw delegate private key in x-delegate-key header on every POST

[ShahMeerMurtaza]

Surface

Dashboard / Console (memory.walrus.xyz)

Network

Mainnet (relayer.memory.walrus.xyz)

Package version

@mysten-incubation/memwal@0.1.8, commit c8e072a (dev branch)

What happened?

Playground apiCall attaches the raw 64-hex delegate secret as x-delegate-key on every POST. apiGet in the same file works without it.

Steps to reproduce

1. Open Dashboard Playground → enter delegate key → submit a remember.
2. DevTools → Network → POST → Request Headers → x-delegate-key: <64-hex secret> present.
3. Run any GET via apiGet in the same file — header absent, request still 200.

Expected

Signature-only auth (x-public-key/x-signature/x-timestamp/x-nonce/x-account-id + x-seal-session). SDK contract: packages/sdk/src/memwal.ts:1426-1529, manual.ts:844-875.

Actual

Long-term secret in header on every POST (apps/app/src/utils/api.ts:78-85), accepted as legacy (services/server/src/auth.rs:203-229). Retained in proxy/CDN/access logs even over TLS; theft = full impersonation until on-chain removal.

Logs or error text

Request Headers (DevTools): x-delegate-key: <64-hex redacted>
Code refs: apps/app/src/utils/api.ts:78-85 vs :108-136; packages/sdk/src/memwal.ts:1426-1529

Checks

• I searched existing issues and this is not a duplicate.
• This report contains no private keys, mnemonics, or other secrets.

[github-actions]

Thank you for opening this issue, a team member will review it shortly.