Repository navigation
feat: one-key client for the new private key - #155
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Tested locally at this PR's head (
No key showed up in the SDK's output or logs. All passed. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
A padded ak_eu_ key passed the empty check, missed the prefix match, defaulted to US, and went on the wire with the spaces. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Shahroz16
left a comment
Shahroz16
left a comment
There was a problem hiding this comment.
Approving from my side. Two small wording bits:
Could we avoid saying every 401/403 means the key can't do something? An IP restriction or a disabled workspace can return those too. The original error is still there, so a more general message should be enough here.
The README's “Legacy App API keys also work here” could use the Track limitation too: legacy keys work for transactional calls, but Bearer Track calls on Pipelines workspaces need a source-bound new key.
That's my take. Let's also get Bernard or the NF team to review this.
Read the region from any key shaped {xx}_{us|eu}_ and treat pk_ as the
public key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nd qualify legacy keys in the README Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
The 401/403 message now says the server refused the request and points to the key type, IP restrictions and workspace status, with the original error kept as |
Shahroz16
left a comment
Shahroz16
left a comment
There was a problem hiding this comment.
Looks good. A few small things, none blocking.
| capability, | ||
| "The server refused this request to #{CAPABILITY_ACTIONS[capability]} (#{e.code}): #{e.message}. " \ | ||
| "Check the key type, its IP restrictions and the workspace status.", | ||
| e.code |
There was a problem hiding this comment.
code comes through as a String here ("401"), since that's what InvalidResponse holds, while Node and Python give an integer. Could we pass e.code.to_i?
There was a problem hiding this comment.
Done in 5865af8. KeyCapabilityError#code is now an Integer (e.code.to_i), and the specs check 401/403 as numbers.
| end | ||
|
|
||
| def trigger_broadcast(req) | ||
| guard(:transactional) { api_client.trigger_broadcast(req) } |
There was a problem hiding this comment.
A refused broadcast reads …to send transactional messages, since this goes through guard(:transactional). Could broadcasts get their own capability or wording? Node and Python don't have trigger_broadcast on the one-key client, so it might also be worth lining those up.
There was a problem hiding this comment.
Done in 5865af8. trigger_broadcast now has its own :broadcast capability, so a refusal reads "trigger broadcasts" for both a pk_ key and a server 401/403. I kept the method rather than dropping it, since that was the smaller change; README and specs are updated.
|
|
||
| match = KEY_PREFIX.match(api_key) | ||
| @key_kind = match ? match[1].to_sym : :legacy | ||
| @region = options[:region] || (match && match[2] == "eu" ? Regions::EU : Regions::US) |
There was a problem hiding this comment.
If region: disagrees with the key, say an sk_eu_ key with Regions::US, the App API answers with a 301 to beta-api-eu.customer.io and this raises it as an InvalidResponse, while Track answers 401 this key belongs to the eu region. A prefixed key only belongs to one region, so could we raise here when they disagree?
There was a problem hiding this comment.
Done in 5865af8. A prefixed key with a different region: now raises ArgumentError in the constructor (region us does not match the eu region of this key, same wording as Python). Legacy keys still take any region, and the README no longer says an explicit region overrides the key.
…use a region that disagrees with the key Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… show the server's reason, and only read pk_/sk_ prefixes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0f11b4e. Configure here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shahroz16
left a comment
Shahroz16
left a comment
There was a problem hiding this comment.
Looks good to me. Custom regions are accepted, every URL has to be https, and refusals show the server's reason now.
2 participants
Adds a one-key client for the new secret
sk_API keys.sk_key covers Track and the App API, sent as a Bearer token.sk_us_…/sk_eu_…).pk_keys are refused for App API calls, since they are for tracking only.