Repository navigation
Add API key format validation #4
Description
Description:
API keys must conform to a format (e.g. pk_live_, sk_live_, pk_test_, sk_test_ prefixes). Catching a malformed key before the first network call saves developers from cryptic 401 errors. Validation should also enforce that a live key is not accidentally used with the sandbox environment, and vice versa.
Proposed Steps:
- Write a
validate_api_key(key: str, environment: Environment)function inconfig.py. - Check prefix, minimum length, and character set.
- Warn (but do not raise) when a
test_key is used withPRODUCTIONor alive_key withSANDBOX. - Call this in the
ShadeClientconstructor and in the global setter.
Acceptance Criteria:
- A key not matching the expected format raises
AuthenticationErrorat configuration time, not at request time. - A
pk_test_key used withenvironment="production"emits aUserWarning. - A valid
sk_live_key passes validation without error. -
Noneor empty string raisesAuthenticationErrorimmediately.
Activity
yeiner-45 commentedon Jun 20, 2026
Hi! I would love to take on this issue. Validating API keys client-side is an excellent way to improve the developer experience and prevent confusing 401 network errors. I have a strong background in software logic, validation patterns, and exception handling. I can easily implement the validate_api_key logic in config.py using clean string manipulation and character set checks, ensure the proper UserWarning is emitted for environment mismatches without breaking execution, and integrate it into the ShadeClient constructor. Ready to work on this right away!
xJeffx23 commentedon Jun 20, 2026
Hello!
My name is Jefferson, and I have been contributing to open-source projects for over a year. I have participated in multiple hackathons and have experience working with SDKs, API integrations, and developer-focused tooling.
I would like to work on this issue because validating API keys at configuration time provides a much better developer experience than surfacing errors only after a request is made. Early validation can prevent common configuration mistakes and make authentication issues easier to diagnose.
My plan would be to implement a
validate_api_keyfunction that validates prefixes, minimum length, and allowed characters, while also checking for environment mismatches and emitting warnings when appropriate. I would integrate the validation into the client initialization flow and global configuration setters, then add tests covering invalid keys, empty values, warning scenarios, and valid production keys.I would greatly appreciate the opportunity to contribute to the project. Thank you for your time and consideration!
grantfox-oss commentedon Jun 25, 2026
🦊 GrantFox — @yeiner-45 has been assigned to this issue as part of the Official Campaign campaign!
Next steps:
Closes #4)Good luck! Track your progress on GrantFox.
codebestia commentedon Jun 29, 2026
Hello @yeiner-45
What is the update with this task?
Please raise a PR within 6 hours.
grantfox-oss commentedon Jul 20, 2026
🦊 GrantFox — @yeiner-45 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!
Next steps:
Closes #4)Good luck! Track your progress on GrantFox.
codebestia commentedon Jul 29, 2026
Hello @yeiner-45
What is the update with this issue?
Please raise a PR within 12 hours.
guptakumarranjeet150 commentedon Sep 13, 2026
Hi maintainers,
I would like to resolve this issue. Here is my proposed execution plan:
Add API key format validationwith strict input validation, proper HTTP error codes, and idempotent execution.I am ready to start immediately—please assign this to me!
rupesh-kumar-sah commentedon Sep 30, 2026
Hey team,
I can tackle
Add API key format validation. Proposed implementation roadmap:ShadeProtocol/shade-pythonAdd API key format validationensuring proper HTTP status codes and error propagation.Ready to deliver a clean, tested PR within 12–24 hours. Please assign!