---
# System prepended metadata

title: AppStudio Proxy

---

# AppStudio Proxy

### 1. Proxy Flow 

```sequence
HAC -> Proxy: Kube Request with SSO Token
Proxy -> Proxy: Parse token & extract User ID
Proxy -> Host: Get Target Cluster and Workspace/namespace for user
Host -> Proxy:
Proxy -> Member: Obtain SA token from namespace
Member -> Proxy:
Proxy -> Proxy : Swap tokens
Proxy -> Member: Forward request
Member -> Proxy:
Proxy -> HAC:
```


#### Notes 
1. During AppStudio user signup & workspace creation a workspace and user is created in Sandbox/AppStudio.
2. Each workspace/namespace has Service Accounts created by Sandbox when a user is added to a workspace. This SA represents a user and has permissions defined by the user's role in the workspace (e.g. admin, owner, developer, etc).
