@takaro/apiclient 0.0.0-dev.ec6d0e0 → 0.0.0-dev.ecb54e3

package/README.md

@@ -2,8 +2,35 @@
 
 Automatically generated API client for Takaro.
 
+## Authentication
+
+Scripted callers — bots, CI jobs, integrations, the billing reconciler — authenticate with a
+Takaro **API Key**, which `Client` accepts directly:
+
+```ts
+import { Client } from '@takaro/apiclient';
+
+// An API Key. The checksum is validated locally, so a mistyped key throws here, not on first call.
+const client = new Client({ url, auth: { apiKey: process.env.TAKARO_API_KEY } });
+await client.player.playerControllerSearch({});
+```
+
+No `login()` call is needed — the key already picks the domain, goes straight onto every request
+as `Authorization: Bearer <key>`, and its secret is shown once at creation time. `POST /login` and
+this library's `login()` exist for the hosted browser login page only. See
+[`docs/api/authentication.md`](../../docs/api/authentication.md) for the full guide (creating a
+key, its format, scope, expiry and rotation).
+
+A hosting company integrates with `DistributorClient` instead, authenticated by a Distributor Key
+rather than an API Key — see [`docs/api/distributors.md`](../../docs/api/distributors.md).
+
 ## Usage
 
+> **Deprecated.** The `auth.username` / `auth.password` + `login()` example below uses Keycloak's
+> resource-owner password grant, which is for the browser login page only. Use an API Key instead
+> (see [Authentication](#authentication)). Nothing breaks today; the password mode is not being
+> removed.
+
 ```ts
 import { AdminClient, Client } from '@takaro/apiclient';