#10375 fix: stop sending the Meltano Cloud login token to an explicitly configured Hub Pull request opened by ReubenFrankel Description A user who is logged in to Meltano Cloud sends their Cloud login token to any Hub that a project points at. Someone who clones a project with a custom

hub_url

or

hub_api_root

and runs

meltano add

,

meltano hub list

or

meltano hub ping

hands their token to whoever runs that Hub. This has been true since

4.3.0

(#10328). The Hub client attached the Cloud token whenever the user was logged in and

hub_url_auth

was not set, whichever Hub the request went to. It now attaches the token only when no Hub is explicitly configured, which is the only case where the request goes to Meltano Cloud. •

MeltanoHubService

attaches the Cloud token only when

has_configured_hub

is false. • The tests for a custom

hub_url

and a custom

hub_api_root

check that the session carries no

Authorization

header. They fail without the change. Behaviour changes • A project that sets

hub_url

or

hub_api_root

no longer sends the Cloud token to that Hub. A private Hub that needs credentials still gets them from

hub_url_auth

. The public Hub does not need a token. Checklist • I have read the contribution guide Was generative AI tooling used to co-author this PR? • Yes (please specify the tool below) Generated-by: Claude Code following the agentic coding guidelines Related Issues • None --- 🤖 Generated with Claude Code Summary by Sourcery Restrict Cloud authentication to the default Meltano Cloud Hub while preserving explicitly configured Hub credentials. Bug Fixes: • Prevent sending Meltano Cloud login tokens to explicitly configured custom Hubs. Tests: • Verify that requests to custom Hub URLs and API roots do not include an Authorization header. meltano/meltano