@zyphr-dev/node-sdk 0.1.43 → 0.1.45

package/README.md

@@ -381,16 +381,18 @@ await zyphr.devices.deleteUserDevices('user_123');
 
 Full Auth-as-a-Service API for end-user authentication: registration, login, MFA, magic links, OAuth, and more.
 
-> **Important:** Auth endpoints require application credentials, not just an API key. Create an application in the Zyphr dashboard first, then pass the credentials when constructing the client:
+> **Important:** Auth endpoints use **Application-scoped** credentials (`X-Application-Key` + `X-Application-Secret`), which are distinct from the **Project-scoped** notification API key (`zy_live_*` / `zy_test_*`, sent as `Authorization: Bearer`). Create an application in the Zyphr dashboard first, then pass the credentials when constructing the client:
 
 ```ts
 const zyphr = new Zyphr({
-  apiKey: process.env.ZYPHR_API_KEY!,
-  applicationKey: process.env.ZYPHR_APP_PUBLIC_KEY!,   // za_pub_*
-  applicationSecret: process.env.ZYPHR_APP_SECRET_KEY!, // za_sec_*
+  apiKey: process.env.ZYPHR_API_KEY!,                   // Project-scoped: zy_live_* / zy_test_*
+  applicationKey: process.env.ZYPHR_APP_PUBLIC_KEY!,    // Application-scoped public: za_live_pub_* / za_test_pub_*
+  applicationSecret: process.env.ZYPHR_APP_SECRET_KEY!, // Application-scoped secret: za_live_sec_* / za_test_sec_*
 });
 ```
 
+> Legacy `za_pub_*` / `za_sec_*` application-key prefixes are deprecated but still accepted.
+
 > **Common mistake:** `POST /v1/auth/register` creates a **platform account** (for the Zyphr dashboard). To register **end users** in your application, use `POST /v1/auth/users/register` via `zyphr.auth.registration.registerEndUser()`.
 
 ```ts