@zyphr-dev/node-sdk 0.1.56 → 0.1.58

package/src/src/apis/AuthEmailVerificationApi.ts

@@ -57,7 +57,7 @@ export interface AuthEmailVerificationApiSendEmailVerificationOperationRequest {
  */
 export interface AuthEmailVerificationApiInterface {
     /**
-     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
+     * Verify the user\'s email using the token from the emailed link. Zyphr does NOT host auth pages and never redeems the token itself. The emailed link points at YOUR `redirect_url` with `?token=<raw>`; your app reads that token and posts it here. Nothing is verified until this call. This endpoint is idempotent: re-posting an already-redeemed token returns `200` with `already_verified: true` rather than an error, so a double submit or a link opened twice is safe. Only a genuinely invalid / expired / unknown token returns `400`. Note `redirect_url` is REQUIRED (snake_case) when sending the verification email — there is no hosted fallback page.
      * @summary Confirm email verification
      * @param {ConfirmEmailVerificationRequest} confirmEmailVerificationRequest 
      * @param {*} [options] Override http request option.
@@ -67,7 +67,7 @@ export interface AuthEmailVerificationApiInterface {
     confirmEmailVerificationRaw(requestParameters: AuthEmailVerificationApiConfirmEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConfirmEmailVerificationResponse>>;
 
     /**
-     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
+     * Verify the user\'s email using the token from the emailed link. Zyphr does NOT host auth pages and never redeems the token itself. The emailed link points at YOUR `redirect_url` with `?token=<raw>`; your app reads that token and posts it here. Nothing is verified until this call. This endpoint is idempotent: re-posting an already-redeemed token returns `200` with `already_verified: true` rather than an error, so a double submit or a link opened twice is safe. Only a genuinely invalid / expired / unknown token returns `400`. Note `redirect_url` is REQUIRED (snake_case) when sending the verification email — there is no hosted fallback page.
      * Confirm email verification
      */
     confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse>;
@@ -112,7 +112,7 @@ export interface AuthEmailVerificationApiInterface {
 export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEmailVerificationApiInterface {
 
     /**
-     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
+     * Verify the user\'s email using the token from the emailed link. Zyphr does NOT host auth pages and never redeems the token itself. The emailed link points at YOUR `redirect_url` with `?token=<raw>`; your app reads that token and posts it here. Nothing is verified until this call. This endpoint is idempotent: re-posting an already-redeemed token returns `200` with `already_verified: true` rather than an error, so a double submit or a link opened twice is safe. Only a genuinely invalid / expired / unknown token returns `400`. Note `redirect_url` is REQUIRED (snake_case) when sending the verification email — there is no hosted fallback page.
      * Confirm email verification
      */
     async confirmEmailVerificationRaw(requestParameters: AuthEmailVerificationApiConfirmEmailVerificationOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ConfirmEmailVerificationResponse>> {
@@ -130,11 +130,25 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -149,7 +163,7 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
     }
 
     /**
-     * Verify the user\'s email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user\'s verified state back and report that — correct whether or not the link already consumed the token.
+     * Verify the user\'s email using the token from the emailed link. Zyphr does NOT host auth pages and never redeems the token itself. The emailed link points at YOUR `redirect_url` with `?token=<raw>`; your app reads that token and posts it here. Nothing is verified until this call. This endpoint is idempotent: re-posting an already-redeemed token returns `200` with `already_verified: true` rather than an error, so a double submit or a link opened twice is safe. Only a genuinely invalid / expired / unknown token returns `400`. Note `redirect_url` is REQUIRED (snake_case) when sending the verification email — there is no hosted fallback page.
      * Confirm email verification
      */
     async confirmEmailVerification(confirmEmailVerificationRequest: ConfirmEmailVerificationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ConfirmEmailVerificationResponse> {
@@ -169,7 +183,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.accessToken) {
@@ -181,7 +202,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -216,7 +244,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.accessToken) {
@@ -228,7 +263,14 @@ export class AuthEmailVerificationApi extends runtime.BaseAPI implements AuthEma
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthLoginApi.ts

@@ -81,11 +81,25 @@ export class AuthLoginApi extends runtime.BaseAPI implements AuthLoginApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthMFAApi.ts

@@ -234,11 +234,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -278,11 +292,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -323,11 +351,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -369,11 +411,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -415,11 +471,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -461,11 +531,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -507,11 +591,25 @@ export class AuthMFAApi extends runtime.BaseAPI implements AuthMFAApiInterface {
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthMagicLinksApi.ts

@@ -107,11 +107,25 @@ export class AuthMagicLinksApi extends runtime.BaseAPI implements AuthMagicLinks
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -153,11 +167,25 @@ export class AuthMagicLinksApi extends runtime.BaseAPI implements AuthMagicLinks
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({

package/src/src/apis/AuthOAuthApi.ts

@@ -311,7 +311,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -359,7 +366,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -409,7 +423,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -456,7 +477,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -506,11 +534,25 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -595,7 +637,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -627,7 +676,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
         const headerParameters: runtime.HTTPHeaders = {};
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -675,11 +731,25 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
         headerParameters['Content-Type'] = 'application/json';
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Secret"] = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Secret"); // ApplicationSecret authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Secret"] = apiKeyValue;
+                }
+            }
         }
 
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({
@@ -738,7 +808,14 @@ export class AuthOAuthApi extends runtime.BaseAPI implements AuthOAuthApiInterfa
             }
         }
         if (this.configuration && this.configuration.apiKey) {
-            headerParameters["X-Application-Key"] = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+            // An unresolved credential must produce NO header, not an empty one (sc-8162).
+            {
+                const apiKeyValue = await this.configuration.apiKey("X-Application-Key"); // ApplicationPublicKey authentication
+
+                if (apiKeyValue) {
+                    headerParameters["X-Application-Key"] = apiKeyValue;
+                }
+            }
         }
 
         const response = await this.request({