@zyphr-dev/node-sdk 0.1.55 → 0.1.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zyphr-dev/node-sdk",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "description": "Official Zyphr SDK for Node.js, React, and React Native",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/clientAuth.ts

@@ -49,7 +49,6 @@ import {
   AuthSessionsApi,
   AuthUserProfileApi,
   AuthWebAuthnApi,
-  DevicesApi,
   UtilityApi,
 } from './src/apis/index.js';
 import { parseErrorResponse } from './errors.js';
@@ -136,8 +135,21 @@ export class ZyphrClient {
     readonly webauthn: AuthWebAuthnApi;
   };
 
-  /** Device registration for push (takes an OS-acquired token). */
-  readonly devices: DevicesApi;
+  // NOTE: `devices` is deliberately NOT exposed here (sc-8045).
+  //
+  // The device API authenticates with the account-scoped secret key
+  // (`X-API-Key`), which must never ship inside a client bundle. ZyphrClient
+  // only ever resolves the publishable `X-Application-Key`, so every call
+  // sent an empty `X-API-Key` header and could only ever 401.
+  //
+  // Register devices from your own backend with the server-side `Zyphr`
+  // client instead:
+  //
+  //   const zyphr = new Zyphr({ apiKey: process.env.ZYPHR_API_KEY });
+  //   await zyphr.devices.registerDevice({ userId, platform, token });
+  //
+  // Derive `userId` from your authenticated session server-side — never from
+  // client-supplied input.
 
   /**
    * Utility endpoints that are publishable-key-safe: the application's password
@@ -203,7 +215,6 @@ export class ZyphrClient {
       profile: new AuthUserProfileApi(config),
       webauthn: new AuthWebAuthnApi(config),
     };
-    this.devices = new DevicesApi(config);
     this.utility = new UtilityApi(config);
   }
 

package/src/src/apis/AuthApplicationApi.ts

@@ -150,11 +150,25 @@ export class AuthApplicationApi extends runtime.BaseAPI implements AuthApplicati
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -195,11 +209,25 @@ export class AuthApplicationApi extends runtime.BaseAPI implements AuthApplicati
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthEmailOTPApi.ts

@@ -162,7 +162,14 @@ export class AuthEmailOTPApi extends runtime.BaseAPI implements AuthEmailOTPApiI
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -203,11 +210,25 @@ export class AuthEmailOTPApi extends runtime.BaseAPI implements AuthEmailOTPApiI
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -249,11 +270,25 @@ export class AuthEmailOTPApi extends runtime.BaseAPI implements AuthEmailOTPApiI
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -295,11 +330,25 @@ export class AuthEmailOTPApi extends runtime.BaseAPI implements AuthEmailOTPApiI
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -341,11 +390,25 @@ export class AuthEmailOTPApi extends runtime.BaseAPI implements AuthEmailOTPApiI
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthEmailTemplatesApi.ts

@@ -299,11 +299,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -343,11 +357,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -386,11 +414,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -429,11 +471,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -471,11 +527,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -506,11 +576,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -551,11 +635,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -602,11 +700,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -654,11 +766,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -707,11 +833,25 @@ export class AuthEmailTemplatesApi extends runtime.BaseAPI implements AuthEmailT
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthEmailVerificationApi.ts

@@ -130,11 +130,25 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -169,7 +183,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.accessToken) {
@@ -181,7 +202,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -216,7 +244,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.accessToken) {
@@ -228,7 +263,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthLoginApi.ts

@@ -81,11 +81,25 @@ export class AuthLoginApi extends runtime.BaseAPI implements AuthLoginApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({