Repository navigation
Add request authentication header injection #9
Description
Description
Every outgoing request must carry an Authorization: Bearer <secret_key> header derived from the active config. This logic must live in the HTTP client, not scattered across resource methods, so it is impossible to accidentally omit it.
Proposed Steps
- In
_SyncHTTPClientand_AsyncHTTPClient, acceptapi_keyin the constructor. - Merge
{"Authorization": f"Bearer {api_key}"}into the default headers on every request. - Never log or include the full key in debug output — mask to
sk_live_****xxxx. - Ensure public key (
pk_) cannot be used for mutating requests (POST/PATCH/DELETE) — raiseAuthenticationError.
Acceptance Criteria
- Every request carries an
Authorizationheader with the correct bearer token. - Debug logs show a masked key, never the full secret.
- Using a public key for a write request raises
AuthenticationErrorbefore the network call. - Changing
api_keyon the client causes subsequent requests to use the new key.
Activity
Awointa commentedon Jun 20, 2026
Hi, I’m interested in this issue. I have experience building SDKs and API clients with secure authentication and request middleware design.
I can implement centralized bearer token handling in both sync and async HTTP clients, enforce automatic Authorization headers on every request, mask secret keys in logs, block public keys from mutating requests, and add tests to verify secure key handling and request behavior.
grantfox-oss commentedon Jun 24, 2026
🦊 GrantFox — @Awointa has been assigned to this issue as part of the Official Campaign campaign!
Next steps:
Closes #9)Good luck! Track your progress on GrantFox.
codebestia commentedon Jun 29, 2026
Hello @Awointa
What is the update with this task?
Please raise a PR within 6 hours.
grantfox-oss commentedon Jul 24, 2026
🦊 GrantFox — @Awointa has been assigned to this issue as part of the Official Campaign | FWC26 campaign!
Next steps:
Closes #9)Good luck! Track your progress on GrantFox.
guptakumarranjeet150 commentedon Sep 13, 2026
Hey team,
I would love to take this on. My planned approach:
Add request authentication header injectionstrictly followingShadeProtocol/shade-pythonconventions.Excited to work on this—please assign to me and I'll submit a clean PR shortly!
rupesh-kumar-sah commentedon Sep 30, 2026
Hey team,
I would love to take this on. My planned approach:
Add request authentication header injectionaddressing all stated requirements.I am ready to start immediately—please feel free to assign this to me!