@bytescale/sdk 3.57.0 → 3.59.0

package/dist/types/private/model/AuthManagerInterface.d.ts

@@ -1,96 +1,4 @@
-import { BytescaleApiClientConfig } from "../../public/shared";
-import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
-export interface AuthManagerServiceWorkerConfig {
-    /**
-     * Additional download-only service-worker authorization rules.
-     * An empty array clears all additional rules.
-     */
-    additionalConfig: AuthSwConfigEntryDto[];
-    /**
-     * Restricts the primary JWT to pages and iframes whose URL starts with one of these prefixes.
-     * An empty array matches no clients. Omit this field to preserve the existing service-worker behavior.
-     * History API changes do not update the matched client URL.
-     */
-    sourceUrlPrefixes?: string[];
-}
-export interface BeginAuthSessionParams {
-    /**
-     * The account ID to authorize requests for.
-     */
-    accountId: string;
-    /**
-     * Headers to send to your backend API.
-     *
-     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
-     */
-    authHeaders: () => Promise<Record<string, string>>;
-    /**
-     * The fully-qualified URL for your backend API's auth endpoint (the endpoint that returns a JWT as plain text).
-     */
-    authUrl: string;
-    /**
-     * Optional configuration.
-     */
-    options?: Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;
-    /**
-     * Returns configuration for service-worker authorization. The primary JWT returned by `authUrl` is restricted using
-     * `sourceUrlPrefixes`; `additionalConfig` contains download-only rules and never authenticates SDK API operations.
-     * Called when the session begins and again 20 seconds before the earliest additional entry expires. Entries without
-     * an expiry do not trigger a refresh.
-     *
-     * Requires `serviceWorkerScript` and browser service-worker support. Additional rules cannot use the CDN cookie
-     * fallback.
-     *
-     * IMPORTANT: do not call 'AuthManager.beginAuthSession' or 'AuthManager.endAuthSession' inside this callback, as this will cause a deadlock.
-     */
-    serviceWorkerConfig?: () => Promise<AuthManagerServiceWorkerConfig>;
-    /**
-     * Enables support for modern browsers that block third-party cookies (like Safari).
-     *
-     * The value of this field must be the path to the service worker JavaScript file hosted at the root of your website.
-     *
-     * OVERVIEW:
-     *
-     * This feature works by running a "service worker" in the background that adds "Authorization" and "Authorization-Token"
-     * request headers to HTTP requests made to the Bytescale CDN. This allows the Bytescale CDN to authorize requests
-     * to private files using JWTs issued by your application. Historically, these requests have been authorized using
-     * JWT cookies (i.e. JWTs sent to the Bytescale CDN via the "Cookies" header). However, modern browsers are starting
-     * to block these cookies, meaning "Authorization" request headers must be used instead. Authorization headers can
-     * only be added to requests originating from page elements like "<img>" elements through the use of service workers.
-     *
-     * INSTRUCTIONS:
-     *
-     * 1. Your JWT must include the 'accountId' field at the root of the 'payload' section of the JWT (i.e. next to the 'exp' field).
-     *
-     * 2. Create a JavaScript file that contains the following line:
-     *
-     *      importScripts("https://js.bytescale.com/auth-sw/v1");
-     *
-     * 3. Host this JavaScript file from your website:
-     *
-     *    3a. It MUST be under the ROOT directory of your website.
-     *        (e.g. "/bytescale-auth-sw.js")
-     *
-     *    3b. It MUST be on the SAME DOMAIN as your website.
-     *        (e.g. "www.example.com" and not "assets.example.com")
-     *
-     * 4. Specify the absolute path to your JavaScript file in the 'beginAuthSession' call.
-     *    (e.g. { ..., serviceWorkerScript: "/bytescale-auth-sw.js" })
-     *
-     * Examples:
-     *
-     * - CORRECT:   "/bytescale-auth-sw.js"
-     * - INCORRECT: "bytescale-auth-sw.js"
-     * - INCORRECT: "/scripts/bytescale-auth-sw.js"
-     * - INCORRECT: "https://example.com/bytescale-auth-sw.js"
-     *
-     * Why does the script need to be hosted on the website's domain, under the root directory?:
-     *
-     * Service workers can only interact with events raised by pages at the same level or below them, hence why your
-     * script must be hosted on your website's domain in the root directory.
-     */
-    serviceWorkerScript?: string;
-}
+import { BeginAuthSessionParams } from "./BeginAuthSessionParams";
 export interface AuthManagerInterface {
     /**
      * Begins a JWT auth session with the Bytescale API and Bytescale CDN.

package/dist/types/private/model/AuthSession.d.ts

@@ -1,14 +1,21 @@
-import { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "./AuthManagerInterface";
-import { AuthSwConfigEntryDto } from "../dtos/AuthSwConfigEntryDto";
 import { ServiceWorkerConfig } from "./ServiceWorkerConfig";
+import { BeginAuthSessionParams } from "./BeginAuthSessionParams";
+import { AuthSessionConfig } from "./AuthSessionConfig";
+export interface AuthSessionConfigState {
+    accessToken: string | undefined;
+    config: AuthSessionConfig;
+    expiresAt: number | undefined;
+    jwt: string | undefined;
+    refreshHandle: number | undefined;
+}
 export interface AuthSession {
+    /** Legacy default-token fields retained for SDK 3.54.0 bundles sharing this global state. */
     accessToken: string | undefined;
     accessTokenRefreshHandle: number | undefined;
+    authConfigs?: AuthSessionConfigState[];
     authServiceWorker: ServiceWorkerConfig | undefined;
     isActive: boolean;
     isReady?: boolean;
     params: BeginAuthSessionParams;
-    primaryAuthSwConfig: AuthSwConfigEntryDto | undefined;
-    serviceWorkerConfig: AuthManagerServiceWorkerConfig | undefined;
-    serviceWorkerConfigRefreshHandle: number | undefined;
+    serviceWorkerConfigured?: boolean;
 }

package/dist/types/private/model/AuthSessionConfig.d.ts

@@ -0,0 +1,3 @@
+import { AuthSessionConfigAuto } from "./AuthSessionConfigAuto";
+import { AuthSessionConfigManual } from "./AuthSessionConfigManual";
+export type AuthSessionConfig = AuthSessionConfigAuto | AuthSessionConfigManual;

package/dist/types/private/model/AuthSessionConfigAuto.d.ts

@@ -0,0 +1,6 @@
+import { AuthSessionConfigBase } from "./AuthSessionConfigBase";
+export interface AuthSessionConfigAuto extends AuthSessionConfigBase {
+    authHeaders: () => Promise<Record<string, string>>;
+    authUrl: string;
+    getAuthorizationToken?: never;
+}

package/dist/types/private/model/AuthSessionConfigBase.d.ts

@@ -0,0 +1,12 @@
+export interface AuthSessionConfigBase {
+    /** The Bytescale account authorized by this configuration. */
+    accountId: string;
+    /** A string names this configuration. `undefined` deliberately marks it as the session default. */
+    authConfigId: string | undefined;
+    /** Enables CDN cookie authentication. Defaults to false. */
+    enableCookieAuth?: boolean;
+    /** Enables CDN service-worker authentication. Defaults to true. */
+    enableServiceWorkerAuth?: boolean;
+    /** Restricts service-worker authentication to matching page or iframe URLs. */
+    sourceUrlPrefixes?: string[];
+}

package/dist/types/private/model/AuthSessionConfigManual.d.ts

@@ -0,0 +1,7 @@
+import { AuthSessionConfigBase } from "./AuthSessionConfigBase";
+export interface AuthSessionConfigManual extends AuthSessionConfigBase {
+    authHeaders?: never;
+    authUrl?: never;
+    /** Returns the JWT for this configuration. AuthManager refreshes it based on its validated TTL. */
+    getAuthorizationToken: () => Promise<string>;
+}

package/dist/types/private/model/BeginAuthSessionParams.d.ts

@@ -0,0 +1,3 @@
+import { BeginAuthSessionParamsV1 } from "./BeginAuthSessionParamsV1";
+import { BeginAuthSessionParamsV2 } from "./BeginAuthSessionParamsV2";
+export type BeginAuthSessionParams = BeginAuthSessionParamsV1 | BeginAuthSessionParamsV2;

package/dist/types/private/model/BeginAuthSessionParamsOptions.d.ts

@@ -0,0 +1,2 @@
+import { BytescaleApiClientConfig } from "../../public/shared";
+export type BeginAuthSessionParamsOptions = Pick<BytescaleApiClientConfig, "fetchApi" | "cdnUrl">;

package/dist/types/private/model/BeginAuthSessionParamsV1.d.ts

@@ -0,0 +1,11 @@
+import { BeginAuthSessionParamsOptions } from "./BeginAuthSessionParamsOptions";
+/** The complete AuthManager input supported by SDK 3.54.0. */
+export interface BeginAuthSessionParamsV1 {
+    accountId: string;
+    authConfigs?: never;
+    authHeaders: () => Promise<Record<string, string>>;
+    authUrl: string;
+    options?: BeginAuthSessionParamsOptions;
+    serviceWorkerScript?: string;
+    urlRewriteRules?: never;
+}

package/dist/types/private/model/BeginAuthSessionParamsV2.d.ts

@@ -0,0 +1,16 @@
+import { AuthSessionConfig } from "./AuthSessionConfig";
+import { UrlRewriteRule } from "./UrlRewriteRule";
+import { NonEmptyArray } from "./NonEmptyArray";
+import { BeginAuthSessionParamsOptions } from "./BeginAuthSessionParamsOptions";
+export interface BeginAuthSessionParamsV2 {
+    /** Present only to make the structural distinction from V1 explicit. */
+    accountId?: undefined;
+    authConfigs: () => Promise<NonEmptyArray<AuthSessionConfig>>;
+    authHeaders?: never;
+    authUrl?: never;
+    options?: BeginAuthSessionParamsOptions;
+    /** Required when a configuration enables service-worker authentication or a rewrite rule is present. */
+    serviceWorkerScript?: string;
+    /** Rewrites in-scope requests before service-worker authentication matching. */
+    urlRewriteRules?: UrlRewriteRule[];
+}

package/dist/types/private/model/NonEmptyArray.d.ts

@@ -0,0 +1 @@
+export type NonEmptyArray<T> = readonly [T, ...T[]];

package/dist/types/private/model/UrlRewriteRule.d.ts

@@ -0,0 +1,6 @@
+export interface UrlRewriteRule {
+    /** URL prefix to replace. This URL must be covered by the service worker's origin and scope. */
+    fromUrlPrefix: string;
+    /** Replacement URL prefix. The remainder of the original URL is appended unchanged. */
+    toUrlPrefix: string;
+}

package/dist/types/public/browser/AuthManagerBrowser.d.ts

@@ -1,9 +1,9 @@
-import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
+import { AuthManagerInterface } from "../../private/model/AuthManagerInterface";
 import { AuthSwSetConfigDto } from "../../private/dtos/AuthSwSetConfigDto";
 import { ServiceWorkerUtils } from "../../private/ServiceWorkerUtils";
+import { BeginAuthSessionParams } from "../../private/model/BeginAuthSessionParams";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     private readonly serviceWorkerUtils;
     private readonly authSessionMutex;
@@ -21,20 +21,36 @@ declare class AuthManagerImpl implements AuthManagerInterface {
     isAuthSessionReady(): boolean;
     beginAuthSession(params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
-    private refreshAccessToken;
-    private refreshServiceWorkerConfig;
-    private sendMergedServiceWorkerConfig;
-    private getServiceWorkerConfigRefreshEpoch;
+    private refreshAuthConfig;
+    private sendCurrentServiceWorkerConfig;
     private sendServiceWorkerConfig;
-    private updateSessionReadiness;
+    private getV2Configs;
+    private normalizeV1Config;
+    private validateSessionConfig;
+    private validateUrlRewriteRules;
+    private updateSessionState;
+    private isConfigUsable;
+    private isServiceWorkerEnabled;
+    private isV2Params;
+    private isValidAccountId;
+    private shouldSetCookie;
     private waitForServiceWorker;
     private getAccessTokenUrl;
     private getCdnUrl;
     private deleteAccessToken;
     private setAccessToken;
-    private getAccessToken;
+    private getAuthorizationToken;
+    private validateJwt;
 }
-/**
- * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
- */
+/** Alternative to a static class that allows the implementation to satisfy an interface. */
 export declare const AuthManager: AuthManagerImpl;
+export { BeginAuthSessionParamsV1 } from "../../private/model/BeginAuthSessionParamsV1";
+export { BeginAuthSessionParamsV2 } from "../../private/model/BeginAuthSessionParamsV2";
+export { BeginAuthSessionParams } from "../../private/model/BeginAuthSessionParams";
+export { AuthSessionConfigAuto } from "../../private/model/AuthSessionConfigAuto";
+export { AuthSessionConfigManual } from "../../private/model/AuthSessionConfigManual";
+export { AuthSessionConfig } from "../../private/model/AuthSessionConfig";
+export { AuthSessionConfigBase } from "../../private/model/AuthSessionConfigBase";
+export { UrlRewriteRule } from "../../private/model/UrlRewriteRule";
+export { NonEmptyArray } from "../../private/model/NonEmptyArray";
+export { BeginAuthSessionParamsOptions } from "../../private/model/BeginAuthSessionParamsOptions";

package/dist/types/public/node/AuthManagerNode.d.ts

@@ -1,7 +1,7 @@
-import { AuthManagerInterface, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
+import { AuthManagerInterface } from "../../private/model/AuthManagerInterface";
+import { BeginAuthSessionParams } from "../../private/model/BeginAuthSessionParams";
 export type { AuthSwConfigEntryDto } from "../../private/dtos/AuthSwConfigEntryDto";
 export type { AuthSwHeaderDto } from "../../private/dtos/AuthSwHeaderDto";
-export type { AuthManagerServiceWorkerConfig, BeginAuthSessionParams } from "../../private/model/AuthManagerInterface";
 declare class AuthManagerImpl implements AuthManagerInterface {
     beginAuthSession(_params: BeginAuthSessionParams): Promise<void>;
     endAuthSession(): Promise<void>;
@@ -12,3 +12,13 @@ declare class AuthManagerImpl implements AuthManagerInterface {
  * Alternative way of implementing a static class (i.e. all methods static). We do this so we can use a interface on the class (interfaces can't define static methods).
  */
 export declare const AuthManager: AuthManagerImpl;
+export { BeginAuthSessionParamsV1 } from "../../private/model/BeginAuthSessionParamsV1";
+export { BeginAuthSessionParamsV2 } from "../../private/model/BeginAuthSessionParamsV2";
+export { BeginAuthSessionParams } from "../../private/model/BeginAuthSessionParams";
+export { AuthSessionConfigAuto } from "../../private/model/AuthSessionConfigAuto";
+export { AuthSessionConfigManual } from "../../private/model/AuthSessionConfigManual";
+export { AuthSessionConfig } from "../../private/model/AuthSessionConfig";
+export { AuthSessionConfigBase } from "../../private/model/AuthSessionConfigBase";
+export { UrlRewriteRule } from "../../private/model/UrlRewriteRule";
+export { NonEmptyArray } from "../../private/model/NonEmptyArray";
+export { BeginAuthSessionParamsOptions } from "../../private/model/BeginAuthSessionParamsOptions";

package/dist/types/public/shared/generated/runtime.d.ts

@@ -17,12 +17,13 @@ export interface BytescaleApiClientConfig {
      * Not required for the browser.
      */
     fetchApi?: FetchAPI;
+    /** Must begin with "public_" or "secret_". Optional when an AuthManager configuration authenticates the request. */
+    apiKey?: string;
     /**
-     * Must begin with "public_" or "secret_".
-     *
-     * Please note: if you require JWT-based auth, you must provide an API key to this field, and then call 'AuthManager.beginAuthSession' to start a JWT-based auth session. The JWT's permissions will be merged with the API key's permissions, with precedence given to the JWT.
+     * Selects a named AuthManager configuration. Omit to use the default configuration, or use `false` to disable
+     * AuthManager authentication for this client.
      */
-    apiKey: string;
+    authConfigId?: string | false;
     /**
      * The base URL of the Bytescale API. (Excludes trailing "/".)
      */
@@ -38,7 +39,8 @@ export interface BytescaleApiClientConfig {
     /**
      * Headers to include in all API requests.
      *
-     * These headers take precedence over any headers automatically added by the SDK (e.g. "Authorization", "Content-Type", etc.).
+     * These headers intentionally take precedence over headers automatically added by the SDK, including
+     * "Authorization" and "Authorization-Token". This preserves the SDK's existing custom-header precedence.
      */
     headers?: HTTPHeaders | (() => Promise<HTTPHeaders> | HTTPHeaders);
 }
@@ -51,7 +53,12 @@ export declare class BytescaleApiClientConfigUtils {
     static getApiUrl(config: BytescaleApiClientConfig): string;
     static getCdnUrl(config: Pick<BytescaleApiClientConfig, "cdnUrl">): string;
     static getFetchApi(config: Pick<BytescaleApiClientConfig, "fetchApi">): FetchAPI;
-    static getAccountId(config: Pick<BytescaleApiClientConfig, "apiKey">): string;
+    static getAccountId(config: Pick<BytescaleApiClientConfig, "apiKey" | "authConfigId">): string;
+    static resolveAuthentication(config: Pick<BytescaleApiClientConfig, "apiKey" | "authConfigId">): {
+        accountId: string;
+        headers: HTTPHeaders;
+    };
+    private static getApiKeyAccountId;
     static validate(config: BytescaleApiClientConfig): void;
 }
 /**

package/dist/worker/cjs/main.js

@@ -250,6 +250,55 @@ var AuthSessionState = /*#__PURE__*/function () {
       }
       return window[AuthSessionState.stateKey];
     }
+    /** Resolves request-time auth while remaining compatible with the single-token session used by SDK 3.54.0. */
+  }, {
+    key: "resolveAuthConfig",
+    value: function resolveAuthConfig(authConfigId, requireReadyDefault) {
+      if (authConfigId === false) {
+        return undefined;
+      }
+      var session = AuthSessionState.getSession();
+      if (session === undefined || !session.isActive) {
+        if (typeof authConfigId === "string") {
+          throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+        }
+        return undefined;
+      }
+      if (Array.isArray(session.authConfigs)) {
+        var state = session.authConfigs.find(function (config) {
+          return config.config.authConfigId === authConfigId;
+        });
+        if (state === undefined) {
+          if (typeof authConfigId === "string") {
+            throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+          }
+          return undefined;
+        }
+        if (state.accessToken === undefined || state.expiresAt === undefined || state.expiresAt <= Date.now() || state.jwt === undefined) {
+          var isV2Session = typeof session.params.authConfigs === "function";
+          if (typeof authConfigId === "string" || requireReadyDefault || isV2Session) {
+            throw new Error("AuthManager configuration '".concat(authConfigId !== null && authConfigId !== void 0 ? authConfigId : "default", "' is not ready."));
+          }
+          return undefined;
+        }
+        return {
+          accessToken: state.accessToken,
+          accountId: state.config.accountId,
+          jwt: state.jwt
+        };
+      }
+      if (typeof authConfigId === "string") {
+        throw new Error("No active AuthManager configuration has ID '".concat(authConfigId, "'."));
+      }
+      if (session.accessToken === undefined || typeof session.params.accountId !== "string") {
+        return undefined;
+      }
+      return {
+        accessToken: session.accessToken,
+        accountId: session.params.accountId,
+        jwt: undefined
+      };
+    }
   }]);
 }();
 AuthSessionState.stateKey = "BytescaleSessionState";
@@ -393,12 +442,47 @@ var BytescaleApiClientConfigUtils = /*#__PURE__*/function () {
   }, {
     key: "getAccountId",
     value: function getAccountId(config) {
+      return BytescaleApiClientConfigUtils.resolveAuthentication(config).accountId;
+    }
+  }, {
+    key: "resolveAuthentication",
+    value: function resolveAuthentication(config) {
+      var _a, _b;
+      var apiKey = (_a = config.apiKey) !== null && _a !== void 0 ? _a : undefined;
+      var authConfig = AuthSessionState.resolveAuthConfig(config.authConfigId, apiKey === undefined);
+      var apiKeyAccountId = apiKey === undefined ? undefined : BytescaleApiClientConfigUtils.getApiKeyAccountId(apiKey);
+      if (apiKeyAccountId !== undefined && authConfig !== undefined && apiKeyAccountId !== authConfig.accountId) {
+        throw new Error("The API key belongs to account '".concat(apiKeyAccountId, "', but AuthManager configuration '").concat((_b = config.authConfigId) !== null && _b !== void 0 ? _b : "default", "' belongs to account '").concat(authConfig.accountId, "'."));
+      }
+      if (apiKey !== undefined) {
+        return {
+          accountId: apiKeyAccountId,
+          headers: Object.assign({
+            Authorization: "Bearer ".concat(apiKey)
+          }, authConfig === undefined ? {} : {
+            "Authorization-Token": authConfig.accessToken
+          })
+        };
+      }
+      if ((authConfig === null || authConfig === void 0 ? void 0 : authConfig.jwt) !== undefined) {
+        return {
+          accountId: authConfig.accountId,
+          headers: {
+            Authorization: "Bearer ".concat(authConfig.jwt)
+          }
+        };
+      }
+      throw new Error("Please provide an API key via the 'apiKey' config parameter.");
+    }
+  }, {
+    key: "getApiKeyAccountId",
+    value: function getApiKeyAccountId(apiKey) {
       var _a, _b;
       var accountId;
-      if (BytescaleApiClientConfigUtils.specialApiKeys.includes(config.apiKey)) {
+      if (BytescaleApiClientConfigUtils.specialApiKeys.includes(apiKey)) {
         accountId = BytescaleApiClientConfigUtils.specialApiKeyAccountId;
       } else {
-        accountId = (_b = (_a = config.apiKey.split("_")[1]) === null || _a === void 0 ? void 0 : _a.substr(0, BytescaleApiClientConfigUtils.accountIdLength)) !== null && _b !== void 0 ? _b : "";
+        accountId = (_b = (_a = apiKey.split("_")[1]) === null || _a === void 0 ? void 0 : _a.substr(0, BytescaleApiClientConfigUtils.accountIdLength)) !== null && _b !== void 0 ? _b : "";
         if (accountId.length !== BytescaleApiClientConfigUtils.accountIdLength) {
           throw new Error("Invalid Bytescale API key.");
         }
@@ -408,21 +492,24 @@ var BytescaleApiClientConfigUtils = /*#__PURE__*/function () {
   }, {
     key: "validate",
     value: function validate(config) {
-      var _a;
       // Defensive programming, for users not using TypeScript. Mainly because this is used by UploadWidget users.
       if ((config !== null && config !== void 0 ? config : undefined) === undefined) {
         throw new Error("Config parameter required.");
       }
-      if (((_a = config.apiKey) !== null && _a !== void 0 ? _a : undefined) === undefined) {
-        throw new Error("Please provide an API key via the 'apiKey' config parameter.");
+      if (config.authConfigId !== undefined && config.authConfigId !== false && typeof config.authConfigId !== "string") {
+        throw new Error("The 'authConfigId' config parameter must be a string, false, or undefined.");
       }
-      if (config.apiKey.trim() !== config.apiKey) {
+      if (config.apiKey !== undefined && typeof config.apiKey !== "string") {
+        throw new Error("The 'apiKey' config parameter must be a string when provided.");
+      }
+      if (config.apiKey !== undefined && config.apiKey.trim() !== config.apiKey) {
         // We do not support API keys with whitespace (by trimming ourselves) because otherwise we'd need to support this
         // everywhere in perpetuity (since removing the trimming would be a breaking change).
         throw new Error("API key needs trimming (whitespace detected).");
       }
-      // This performs futher validation on the API key...
-      BytescaleApiClientConfigUtils.getAccountId(config);
+      if (config.apiKey !== undefined) {
+        BytescaleApiClientConfigUtils.getApiKeyAccountId(config.apiKey);
+      }
     }
   }]);
 }();
@@ -449,12 +536,7 @@ var BaseAPI = /*#__PURE__*/function () {
       try {
         var _this = this;
         var _a;
-        var apiKey = _this.config.apiKey;
-        context.headers["Authorization"] = "Bearer ".concat(apiKey); // authorization-header authentication
-        var session = AuthSessionState.getSession();
-        if ((session === null || session === void 0 ? void 0 : session.accessToken) !== undefined) {
-          context.headers["Authorization-Token"] = session.accessToken;
-        }
+        Object.assign(context.headers, BytescaleApiClientConfigUtils.resolveAuthentication(_this.config).headers);
         // Key: any possible value for 'baseUrlOverride'
         // Value: user-overridden value for that base URL from the config.
         var nonDefaultBasePaths = _defineProperty({}, BytescaleApiClientConfigUtils.defaultCdnUrl, BytescaleApiClientConfigUtils.getCdnUrl(_this.config));
@@ -494,9 +576,21 @@ var BaseAPI = /*#__PURE__*/function () {
           url += "?" + querystring(context.query);
         }
         var configHeaders = _this2.config.headers;
-        var _Object$assign = Object.assign({}, context.headers);
-        return runtime_await(runtime_await(configHeaders === undefined ? {} : typeof configHeaders === "function" ? configHeaders() : configHeaders, function (_configHeaders) {
-          var headers = Object.assign(_Object$assign, configHeaders === undefined ? _configHeaders : _configHeaders);
+        return runtime_await(runtime_await(configHeaders === undefined ? {} : typeof configHeaders === "function" ? configHeaders() : configHeaders, function (resolvedConfigHeaders) {
+          for (var _i = 0, _Object$keys = Object.keys(resolvedConfigHeaders); _i < _Object$keys.length; _i++) {
+            var key = _Object$keys[_i];
+            if (key.toLowerCase() === "authorization" || key.toLowerCase() === "authorization-token") {
+              for (var _i2 = 0, _Object$keys2 = Object.keys(context.headers); _i2 < _Object$keys2.length; _i2++) {
+                var generatedKey = _Object$keys2[_i2];
+                if (generatedKey.toLowerCase() === key.toLowerCase()) {
+                  // Custom auth headers have documented precedence; remove the generated spelling to make that deterministic.
+                  // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+                  delete context.headers[generatedKey];
+                }
+              }
+            }
+          }
+          var headers = Object.assign(Object.assign({}, context.headers), resolvedConfigHeaders);
           Object.keys(headers).forEach(function (key) {
             return headers[key] === undefined ? delete headers[key] : {};
           });
@@ -508,12 +602,12 @@ var BaseAPI = /*#__PURE__*/function () {
             headers: headers,
             body: context.body
           };
-          var _Object$assign2 = Object.assign({}, initParams);
+          var _Object$assign = Object.assign({}, initParams);
           return runtime_await(initOverrideFn({
             init: initParams,
             context: context
           }), function (_initOverrideFn) {
-            var overriddenInit = Object.assign(_Object$assign2, _initOverrideFn);
+            var overriddenInit = Object.assign(_Object$assign, _initOverrideFn);
             var init = Object.assign(Object.assign({}, overriddenInit), {
               body: JSON.stringify(overriddenInit.body)
             });
@@ -2138,7 +2232,6 @@ var UploadManagerBase = /*#__PURE__*/function () {
     this.defaultMaxConcurrentUploadParts = 4;
     this.intervalMs = 500;
     this.uploadApi = new UploadApi(config);
-    this.accountId = BytescaleApiClientConfigUtils.getAccountId(config);
   }
   return UploadManagerBase_createClass(UploadManagerBase, [{
     key: "upload",
@@ -2146,6 +2239,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
       try {
         var _this = this;
         _this.assertNotCancelled(request);
+        var accountId = BytescaleApiClientConfigUtils.getAccountId(_this.config);
         var source = _this.processUploadSource(request.data);
         var preUploadInfo = _this.getPreUploadInfo(request, source);
         var bytesTotal = preUploadInfo.size;
@@ -2155,7 +2249,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
         if (request.onProgress !== undefined) {
           request.onProgress(_this.makeProgressEvent(0, bytesTotal));
         }
-        return UploadManagerBase_await(_this.beginUpload(request, preUploadInfo), function (uploadInfo) {
+        return UploadManagerBase_await(_this.beginUpload(request, preUploadInfo, accountId), function (uploadInfo) {
           var partCount = uploadInfo.uploadParts.count;
           var parts = UploadManagerBase_toConsumableArray(Array(partCount).keys());
           var _this$makeCancellatio = _this.makeCancellationMethods(),
@@ -2165,7 +2259,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
           var uploadedParts;
           return UploadManagerBase_continue(UploadManagerBase_finallyRethrows(function () {
             return UploadManagerBase_await(_this.mapAsync(parts, preUploadInfo.maxConcurrentUploadParts, _async(function (part) {
-              return _this.uploadPart(request, source, part, uploadInfo, makeOnProgressForPart(), addCancellationHandler);
+              return _this.uploadPart(request, source, part, uploadInfo, makeOnProgressForPart(), addCancellationHandler, accountId);
             })), function (_this$mapAsync) {
               uploadedParts = _this$mapAsync;
               return UploadManagerBase_awaitIgnored(_this.postUpload(init));
@@ -2277,14 +2371,14 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "beginUpload",
-    value: function beginUpload(request, _ref2) {
+    value: function beginUpload(request, _ref2, accountId) {
       var size = _ref2.size,
         mime = _ref2.mime,
         originalFileName = _ref2.originalFileName;
       try {
         var _this4 = this;
         return UploadManagerBase_await(_this4.uploadApi.beginMultipartUpload({
-          accountId: _this4.accountId,
+          accountId: accountId,
           beginMultipartUploadRequest: {
             metadata: request.metadata,
             mime: mime,
@@ -2301,16 +2395,16 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "uploadPart",
-    value: function uploadPart(request, source, partIndex, uploadInfo, onProgress, addCancellationHandler) {
+    value: function uploadPart(request, source, partIndex, uploadInfo, onProgress, addCancellationHandler, accountId) {
       try {
         var _this5 = this;
         _this5.assertNotCancelled(request);
-        return UploadManagerBase_await(_this5.getUploadPart(partIndex, uploadInfo), function (part) {
+        return UploadManagerBase_await(_this5.getUploadPart(partIndex, uploadInfo, accountId), function (part) {
           _this5.assertNotCancelled(request);
           return UploadManagerBase_await(_this5.putUploadPart(part, source, onProgress, addCancellationHandler), function (etag) {
             _this5.assertNotCancelled(request);
             return UploadManagerBase_await(_this5.uploadApi.completeUploadPart({
-              accountId: _this5.accountId,
+              accountId: accountId,
               uploadId: uploadInfo.uploadId,
               uploadPartIndex: partIndex,
               completeUploadPartRequest: {
@@ -2351,7 +2445,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
     }
   }, {
     key: "getUploadPart",
-    value: function getUploadPart(partIndex, uploadInfo) {
+    value: function getUploadPart(partIndex, uploadInfo, accountId) {
       try {
         var _this7 = this;
         if (partIndex === 0) {
@@ -2359,7 +2453,7 @@ var UploadManagerBase = /*#__PURE__*/function () {
         }
         return UploadManagerBase_await(_this7.uploadApi.getUploadPart({
           uploadId: uploadInfo.uploadId,
-          accountId: _this7.accountId,
+          accountId: accountId,
           uploadPartIndex: partIndex
         }));
       } catch (e) {