Two resolution paths, tried in this order:

1. DSN credential. An explicit ?sentry_key= / X-Sentry-Auth / Authorization: DSN value, or — failing that — the dsn field browser SDKs embed in the envelope header whenever Sentry.init({ tunnel }) is used. The credential alone decides the project; Host and Origin are not consulted. This is what makes the endpoint usable from an app Temps does not deploy, which by definition has no route-table entry at all.
2. Host. Unchanged legacy behaviour for same-origin, Temps-deployed apps: the project/environment/deployment are resolved from the Host header via the proxy's route table, the same way /api/_temps/event (analytics) resolves. The proxy forwards anything under /api/_temps to the console regardless of Host (temps-proxy::services::ROUTE_PREFIX_TEMPS), so it works on custom domains and previews without per-domain DSN configuration.

On path 2 there is no credential, so an Origin/Referer check stands in for authentication: the request must claim to come from the same host it resolves to, or it is rejected. That check is deliberately skipped on path 1 — a tunneled request from another origin is the entire point there, and the DSN is a stronger claim than a self-reported Origin. Path 1 does honour the DSN row's own allowed_origins list when the operator has set one (403 when the Origin is off it); an empty or absent list, which is every row Temps mints today, permits any origin.

Ordering, and why it matters

This route is unauthenticated and reachable from every domain a project is deployed to, so the expensive work is placed strictly after the cheap admission control:

1. Shape gate + resolution cache + a global unresolved-credential budget, all before any database round trip (mirroring temps-analytics's ADR-040 §2 defence).
2. Per-project rate limiting.
3. Only then decompress_if_needed, which can inflate up to MAX_DECOMPRESSED_SIZE.

The credential-free branch has to inflate the body to read an SDK-embedded DSN, so when Host has not already resolved the request that inflate is charged against the same global budget a forged key pays into.

An explicit credential that does not resolve is a 401, never a silent fall-through to Host: a typo'd key must fail loudly rather than land the data under whichever project the Host happens to match. An embedded envelope DSN that does not resolve falls through to path 2, because that value was sniffed rather than presented — an app tunneling a third-party DSN through Temps keeps working exactly as it did before.