From e3f0aa2130f427aaf72c6546e1aa764278f0f2d6 Mon Sep 17 00:00:00 2001
From: root <root@your-cloudcone-server.localdomain>
Date: Sun, 6 Sep 2026 00:54:56 +0000
Subject: [PATCH] fix(installer): align S to E internal auth key id

---
 install.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index b4dde97..b0f304e 100755
--- a/install.sh
+++ b/install.sh
@@ -289,7 +289,11 @@ S_ACCESS_TOKEN_SECRET=$S_ACCESS_TOKEN_SECRET
 S_SETUP_TOKEN=$S_SETUP_TOKEN
 S_E_BASE_URL=http://e-server:8096
 S_E_PUBLIC_URL=http://$SERVER_IP:$E_PORT
-S_E_KEY_ID=customer-e
+# Product E's internal API is protected by the same control-plane verifier
+# configured as PRODUCT_E_CONTROL_PLANE_KEY_ID.  S must therefore sign its
+# S->E requests with that verifier key id (the shared secret is also shared).
+# Keep this aligned so first-run license activation does not receive 401.
+S_E_KEY_ID=customer-s
 S_E_INTERNAL_SECRET=$S_INTERNAL_SHARED_SECRET
 # S's private backend client talks to E on the internal Docker network. This
 # does not weaken E's production mTLS control-plane connection below.