# AppStudio Proxy ### 1. Proxy Flow ```sequence HAC -> Proxy: Kube Request with SSO Token Proxy -> Proxy: Parse token & extract User ID Proxy -> Host: Get Target Cluster and Workspace/namespace for user Host -> Proxy: Proxy -> Member: Obtain SA token from namespace Member -> Proxy: Proxy -> Proxy : Swap tokens Proxy -> Member: Forward request Member -> Proxy: Proxy -> HAC: ``` #### Notes 1. During AppStudio user signup & workspace creation a workspace and user is created in Sandbox/AppStudio. 2. Each workspace/namespace has Service Accounts created by Sandbox when a user is added to a workspace. This SA represents a user and has permissions defined by the user's role in the workspace (e.g. admin, owner, developer, etc).