/auth/polaris-token and /auth/polaris-token/session both get explicit security overrides in api/src/main.py's custom_openapi() that drop ApiKeyAuth. /auth/polaris-session (in api/src/routes/auth.py) has no matching override, so it falls through to the generic default that still includes ApiKeyAuth — but the route body does if identity.auth_type != "jwt": raise HTTPException(403, ...).
Impact: Swagger/OpenAPI docs tell clients this endpoint accepts API-key auth; any client following the docs gets an unexpected 403.
Fix: Add the same security override for /auth/polaris-session as its siblings.
/auth/polaris-token and /auth/polaris-token/session both get explicit security overrides in api/src/main.py's custom_openapi() that drop ApiKeyAuth. /auth/polaris-session (in api/src/routes/auth.py) has no matching override, so it falls through to the generic default that still includes ApiKeyAuth — but the route body does if identity.auth_type != "jwt": raise HTTPException(403, ...).
Impact: Swagger/OpenAPI docs tell clients this endpoint accepts API-key auth; any client following the docs gets an unexpected 403.
Fix: Add the same security override for /auth/polaris-session as its siblings.