@graph8/sdk 0.238.0 → 0.244.0

package/README.md

@@ -324,6 +324,11 @@ Two things to know before reaching for it:
 | `g8.signals.company(domain)` | Get intent signals |
 | `g8.signals.stream(domains, cb)` | Stream signals (polls 30s) |
 
+With an `apiKey`, signals use Bearer auth and the key must carry the `intent:read`
+scope. Personal keys and keys minted before scoped keys do not, and get a `403`,
+which `company()` throws as a `G8Error` explaining the fix (and which stops
+`stream()`). With only a `writeKey`, a failure still resolves to an all-zeros result.
+
 ### Webhooks (API key)
 
 | Method | Description |
@@ -474,6 +479,16 @@ const { data: objects } = await service.request<{ data: unknown[] }>('/api/v1/ap
 
 Get your API key at [app.graph8.com/settings](https://app.graph8.com/settings) under MCP & API > API.
 
+### `X-Target-Org-Id` (agency keys only)
+
+Setting the `X-Target-Org-Id` header on a call switches an **agency** key (minted
+with `is_agency: true`) to one of its authorized client orgs (see `g8.agency.clients()`).
+For any other key the server **ignores the header without an error**: the call runs
+against the key's own org. `/api-keys` and `/agency/*` reject the header with a `400`.
+Once `g8.agency.me()` or `g8.agency.clients()` has shown that a key is not an agency
+key, the SDK logs one console warning the first time that key sends the header. The
+SDK never makes an extra request just to check.
+
 ## License
 
 MIT