fix: Fixed endpoint

server/internal/api/handlers.go

@@ -24,8 +24,11 @@ func RegisterRoutes(r *gin.Engine) {
 	r.GET("/update", handleUpdateScript)
 
 	// ESO read endpoint — bearer-token auth, not session auth, so Kubernetes
-	// External Secrets Operator can call it. Returns a group as flat JSON.
-	r.GET("/secrets/:group", secretsReadAuth(), esoGetGroup)
+	// External Secrets Operator can call it. Lives under /api (so the reverse
+	// proxy routes it to the backend) but on a distinct subpath to avoid
+	// colliding with the session-authed GET /api/secrets/:group. Returns a
+	// group as flat JSON.
+	r.GET("/api/secrets/:group/values", secretsReadAuth(), esoGetGroup)
 
 	// Auth endpoints (no session required)
 	r.GET("/auth/login", auth.HandleLogin)

web/app/secrets/[group]/page.tsx

@@ -65,7 +65,7 @@ metadata:
 spec:
   provider:
     webhook:
-      url: "${readUrl}/secrets/{{ .remoteRef.key }}"
+      url: "${readUrl}/api/secrets/{{ .remoteRef.key }}/values"
       method: GET
       result:
         jsonPath: "$"
@@ -252,7 +252,7 @@ export default function SecretGroupPage() {
                 <div>
                     <h1 className="font-mono text-2xl font-bold text-text-primary">{group}</h1>
                     <p className="mt-1 text-sm text-text-secondary">
-                        ESO reads this group at <span className="font-mono">GET /secrets/{group}</span>
+                        ESO reads this group at <span className="font-mono">GET /api/secrets/{group}/values</span>
                     </p>
                 </div>
                 <div className="flex items-center gap-3">

web/app/settings/page.tsx

@@ -78,8 +78,8 @@ function SecretsTokenCard({
   const [copied, setCopied] = useState(false);
   const readUrl =
     typeof window !== "undefined"
-      ? `${window.location.origin}/secrets/<group>`
-      : "/secrets/<group>";
+      ? `${window.location.origin}/api/secrets/<group>/values`
+      : "/api/secrets/<group>/values";
 
   const { mutate: rotate, isPending } = useMutation({
     mutationFn: api.rotateSecretsToken,