@zyphr-dev/node-sdk 0.1.55 → 0.1.57

package/src/src/apis/AuthOrganizationsApi.ts

@@ -321,11 +321,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -366,11 +380,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -410,11 +438,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -451,11 +493,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -500,11 +556,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -547,11 +617,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -590,11 +674,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -639,11 +737,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -682,11 +794,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -735,11 +861,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -794,11 +934,25 @@ export class AuthOrganizationsApi extends runtime.BaseAPI implements AuthOrganiz
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthPasswordResetApi.ts

@@ -60,7 +60,7 @@ export interface AuthPasswordResetApiValidateResetTokenOperationRequest {
  */
 export interface AuthPasswordResetApiInterface {
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * @summary Request a password reset
      * @param {ForgotPasswordRequest} forgotPasswordRequest 
      * @param {*} [options] Override http request option.
@@ -70,7 +70,7 @@ export interface AuthPasswordResetApiInterface {
     forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>>;
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * Request a password reset
      */
     forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult>;
@@ -115,7 +115,7 @@ export interface AuthPasswordResetApiInterface {
 export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswordResetApiInterface {
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * Request a password reset
      */
     async forgotPasswordRaw(requestParameters: AuthPasswordResetApiForgotPasswordOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<SuccessResult>> {
@@ -133,11 +133,25 @@ export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswor
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -152,7 +166,7 @@ export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswor
     }
 
     /**
-     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration.
+     * Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
      * Request a password reset
      */
     async forgotPassword(forgotPasswordRequest: ForgotPasswordRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<SuccessResult> {
@@ -179,11 +193,25 @@ export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswor
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -225,11 +253,25 @@ export class AuthPasswordResetApi extends runtime.BaseAPI implements AuthPasswor
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthPhoneApi.ts

@@ -162,7 +162,14 @@ export class AuthPhoneApi extends runtime.BaseAPI implements AuthPhoneApiInterfa
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -203,11 +210,25 @@ export class AuthPhoneApi extends runtime.BaseAPI implements AuthPhoneApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -249,11 +270,25 @@ export class AuthPhoneApi extends runtime.BaseAPI implements AuthPhoneApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -295,11 +330,25 @@ export class AuthPhoneApi extends runtime.BaseAPI implements AuthPhoneApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -341,11 +390,25 @@ export class AuthPhoneApi extends runtime.BaseAPI implements AuthPhoneApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthRegistrationApi.ts

@@ -211,11 +211,25 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -257,7 +271,14 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -299,7 +320,14 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -341,7 +369,14 @@ export class AuthRegistrationApi extends runtime.BaseAPI implements AuthRegistra
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({