исправить: закрыть ревью сквозной корреляции

crates/crank-community-mcp/src/rate_limit.rs

@@ -4,6 +4,7 @@ use axum::{
     http::{HeaderMap, HeaderValue, StatusCode, header::RETRY_AFTER},
     response::{IntoResponse, Response},
 };
+use crank_core::PlatformApiKeyKind;
 use crank_runtime::RateLimitCheckError;
 use serde_json::{Value, json};
 
@@ -82,6 +83,13 @@ pub(super) fn rate_limited_status_response(error: RateLimitCheckError) -> Respon
 }
 
 fn rate_limit_key(path: &AgentRoutePath, headers: &HeaderMap) -> String {
+    let access_secret = bearer_token(headers);
+    if let Some(secret) = access_secret
+        && secret.starts_with(PlatformApiKeyKind::Approval.secret_marker())
+    {
+        return format!("api_key:{}", hash_access_secret(secret));
+    }
+
     if let Ok(Some(session_id)) = session_id_from_headers(headers) {
         return format!(
             "session:{}:{}:{}",
@@ -89,7 +97,7 @@ fn rate_limit_key(path: &AgentRoutePath, headers: &HeaderMap) -> String {
         );
     }
 
-    if let Some(secret) = bearer_token(headers) {
+    if let Some(secret) = access_secret {
         return format!("api_key:{}", hash_access_secret(secret));
     }