# Bundle Fingerprint

WHost's web panel sends an `X-WHost-Bundle-Fingerprint` header so the
browser bundle and the agent stay in lock-step. **HMAC-authenticated
requests are exempt** — SDKs and third-party integrations should
**never** send this header and never need to know the agent's current
fingerprint.

The agent skips the fingerprint check when `X-WHost-Key` is non-empty,
then applies the request's authentication and authorization checks. The
key header alone does not authenticate a request. Without a session
cookie, an authorized `GET /api/v1/accounts` request with valid HMAC succeeds even if the
fingerprint header is missing or incorrect; an invalid HMAC signature
returns `401 AUTH_FAILED` in either case.

EventSource streams and OAuth callbacks are exempt only when the
normalized, decoded request path matches a complete permitted route.
Appending a newline, carriage return, or tab does not preserve that
route exemption. These exemptions affect only the fingerprint check;
the route's authentication requirements still apply.

The exemption is enforced agent-side and covered by the agent's
integration tests.

---