authmi 1.2.0 → 1.4.0

package/dist/{chunk-DMNUO422.mjs → chunk-5NJCXFBV.mjs}

@@ -37,8 +37,6 @@ function resolveConfig(provider) {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
     serviceId: raw.serviceId ?? "",
-    clientId: raw.clientId ?? "",
-    clientSecret: raw.clientSecret ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -127,7 +125,7 @@ var AuthMiClient = class {
     return resolveConfig(this.configProvider);
   }
   // ============ HTTP plumbing ============
-  async request(endpoint, options = {}, requireUserToken = false, requireServiceAuth = true) {
+  async request(endpoint, options = {}, requireUserToken = false) {
     const cfg = this.config;
     const url = `${cfg.baseUrl}${endpoint}`;
     const headers = {
@@ -138,10 +136,7 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (requireServiceAuth && cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
-        headers["X-Service-ID"] = cfg.serviceId || cfg.clientId;
-      } else if (requireServiceAuth && cfg.apiKey) {
+      } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
     }
@@ -177,7 +172,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -199,7 +194,7 @@ var AuthMiClient = class {
     const response = await this.request("/api/v1/auth/signup", {
       method: "POST",
       body: JSON.stringify(credentials)
-    }, false, false);
+    });
     return this.mapAuthToken(response);
   }
   async login(credentials) {
@@ -213,7 +208,7 @@ var AuthMiClient = class {
         expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
         scopes: credentials.scopes
       })
-    }, false, false);
+    });
     const token = this.mapAuthToken(response);
     this.setAccessToken(token.accessToken);
     return token;
@@ -249,31 +244,31 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/forgot-password", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async resetPassword(request) {
     return this.request("/api/v1/auth/reset-password", {
       method: "POST",
       body: JSON.stringify({ token: request.token, new_password: request.newPassword })
-    }, false, false);
+    });
   }
   async verifyEmail(request) {
     return this.request("/api/v1/auth/verify-email", {
       method: "POST",
       body: JSON.stringify({ token: request.token })
-    }, false, false);
+    });
   }
   async resendVerification(request) {
     return this.request("/api/v1/auth/resend-verification", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async deactivateAccount(password) {
     await this.request("/api/v1/auth/deactivate", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   mapAuthToken(raw) {
     return {
@@ -290,13 +285,13 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
-    }, false, false);
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
+    });
     return response.url;
   }
   handleOAuthCallback(url) {
@@ -317,13 +312,13 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/saml/initiate", {
       method: "POST",
       body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
-    }, false, false);
+    });
   }
   async parseSamlMetadata(xml) {
     return this.request("/api/v1/auth/saml/parse-metadata", {
       method: "POST",
       body: JSON.stringify({ metadata_xml: xml })
-    }, false, false);
+    });
   }
   async listSamlConnections() {
     const response = await this.request("/api/v1/auth/saml/connections");
@@ -342,28 +337,28 @@ var AuthMiClient = class {
   }
   // ============ 2FA ============
   async setup2fa() {
-    return this.request("/api/v1/auth/2fa/setup", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" });
   }
   async enable2fa(code) {
     return this.request("/api/v1/auth/2fa/enable", {
       method: "POST",
       body: JSON.stringify({ code })
-    }, true, false);
+    });
   }
   async disable2fa(password) {
     await this.request("/api/v1/auth/2fa/disable", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   async regenerateBackupCodes() {
-    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" });
   }
   async challenge2fa(request) {
     return this.request("/api/v1/auth/2fa/challenge", {
       method: "POST",
       body: JSON.stringify(request)
-    }, false, false);
+    });
   }
   // ============ Users ============
   async createUser(request) {
@@ -529,7 +524,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -554,7 +549,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -652,11 +647,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    );
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {

package/dist/{client-DmZsG2xs.d.mts → client-Cj-AA4V9.d.mts}

@@ -5,10 +5,6 @@ interface AuthMiConfig {
     apiKey?: string;
     /** Service ID (svc-xxx) — required for token introspection */
     serviceId?: string;
-    /** Client ID for Basic auth — alternative to apiKey for service-level auth */
-    clientId?: string;
-    /** Client Secret for Basic auth */
-    clientSecret?: string;
     /** Default token expiration in hours (default: 24) */
     defaultTokenExpiry?: number;
 }
@@ -318,7 +314,7 @@ declare class AuthMiClient {
     private get config();
     private request;
     configure(config: Partial<AuthMiConfig>): void;
-    getConfig(): Omit<AuthMiConfig, "apiKey" | "clientSecret">;
+    getConfig(): Omit<AuthMiConfig, "apiKey">;
     getAccessToken(): Promise<string | null>;
     setAccessToken(token: string): void;
     clearAccessToken(): void;
@@ -395,8 +391,8 @@ declare class AuthMiClient {
     getAuditLogs(query?: AuditLogQuery): Promise<AuditLog[]>;
     getService(serviceId: string): Promise<ServiceDetail>;
     updateService(serviceId: string, data: UpdateServiceRequest): Promise<ServiceDetail>;
-    rotateClientSecret(serviceId: string): Promise<{
-        clientSecret: string;
+    rotateServiceKey(serviceId: string): Promise<{
+        serviceKey: string;
     }>;
     getJwks(serviceId: string): Promise<JwksResponse>;
     onboardService(request: OnboardRequest, masterAdminKey: string): Promise<OnboardResponse>;

package/dist/{client-DmZsG2xs.d.ts → client-Cj-AA4V9.d.ts}

@@ -5,10 +5,6 @@ interface AuthMiConfig {
     apiKey?: string;
     /** Service ID (svc-xxx) — required for token introspection */
     serviceId?: string;
-    /** Client ID for Basic auth — alternative to apiKey for service-level auth */
-    clientId?: string;
-    /** Client Secret for Basic auth */
-    clientSecret?: string;
     /** Default token expiration in hours (default: 24) */
     defaultTokenExpiry?: number;
 }
@@ -318,7 +314,7 @@ declare class AuthMiClient {
     private get config();
     private request;
     configure(config: Partial<AuthMiConfig>): void;
-    getConfig(): Omit<AuthMiConfig, "apiKey" | "clientSecret">;
+    getConfig(): Omit<AuthMiConfig, "apiKey">;
     getAccessToken(): Promise<string | null>;
     setAccessToken(token: string): void;
     clearAccessToken(): void;
@@ -395,8 +391,8 @@ declare class AuthMiClient {
     getAuditLogs(query?: AuditLogQuery): Promise<AuditLog[]>;
     getService(serviceId: string): Promise<ServiceDetail>;
     updateService(serviceId: string, data: UpdateServiceRequest): Promise<ServiceDetail>;
-    rotateClientSecret(serviceId: string): Promise<{
-        clientSecret: string;
+    rotateServiceKey(serviceId: string): Promise<{
+        serviceKey: string;
     }>;
     getJwks(serviceId: string): Promise<JwksResponse>;
     onboardService(request: OnboardRequest, masterAdminKey: string): Promise<OnboardResponse>;

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { T as TokenStorage } from './client-DmZsG2xs.mjs';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.mjs';
+import { T as TokenStorage } from './client-Cj-AA4V9.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.mjs';
 
 declare class LocalStorageTokenStorage implements TokenStorage {
     private canAccess;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage } from './client-DmZsG2xs.js';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.js';
+import { T as TokenStorage } from './client-Cj-AA4V9.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.js';
 
 declare class LocalStorageTokenStorage implements TokenStorage {
     private canAccess;

package/dist/index.js

@@ -38,8 +38,6 @@ function resolveConfig(provider) {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
     serviceId: raw.serviceId ?? "",
-    clientId: raw.clientId ?? "",
-    clientSecret: raw.clientSecret ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -128,7 +126,7 @@ var AuthMiClient = class {
     return resolveConfig(this.configProvider);
   }
   // ============ HTTP plumbing ============
-  async request(endpoint, options = {}, requireUserToken = false, requireServiceAuth = true) {
+  async request(endpoint, options = {}, requireUserToken = false) {
     const cfg = this.config;
     const url = `${cfg.baseUrl}${endpoint}`;
     const headers = {
@@ -139,10 +137,7 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (requireServiceAuth && cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
-        headers["X-Service-ID"] = cfg.serviceId || cfg.clientId;
-      } else if (requireServiceAuth && cfg.apiKey) {
+      } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
     }
@@ -178,7 +173,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -200,7 +195,7 @@ var AuthMiClient = class {
     const response = await this.request("/api/v1/auth/signup", {
       method: "POST",
       body: JSON.stringify(credentials)
-    }, false, false);
+    });
     return this.mapAuthToken(response);
   }
   async login(credentials) {
@@ -214,7 +209,7 @@ var AuthMiClient = class {
         expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
         scopes: credentials.scopes
       })
-    }, false, false);
+    });
     const token = this.mapAuthToken(response);
     this.setAccessToken(token.accessToken);
     return token;
@@ -250,31 +245,31 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/forgot-password", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async resetPassword(request) {
     return this.request("/api/v1/auth/reset-password", {
       method: "POST",
       body: JSON.stringify({ token: request.token, new_password: request.newPassword })
-    }, false, false);
+    });
   }
   async verifyEmail(request) {
     return this.request("/api/v1/auth/verify-email", {
       method: "POST",
       body: JSON.stringify({ token: request.token })
-    }, false, false);
+    });
   }
   async resendVerification(request) {
     return this.request("/api/v1/auth/resend-verification", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async deactivateAccount(password) {
     await this.request("/api/v1/auth/deactivate", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   mapAuthToken(raw) {
     return {
@@ -291,13 +286,13 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
-    }, false, false);
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
+    });
     return response.url;
   }
   handleOAuthCallback(url) {
@@ -318,13 +313,13 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/saml/initiate", {
       method: "POST",
       body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
-    }, false, false);
+    });
   }
   async parseSamlMetadata(xml) {
     return this.request("/api/v1/auth/saml/parse-metadata", {
       method: "POST",
       body: JSON.stringify({ metadata_xml: xml })
-    }, false, false);
+    });
   }
   async listSamlConnections() {
     const response = await this.request("/api/v1/auth/saml/connections");
@@ -343,28 +338,28 @@ var AuthMiClient = class {
   }
   // ============ 2FA ============
   async setup2fa() {
-    return this.request("/api/v1/auth/2fa/setup", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" });
   }
   async enable2fa(code) {
     return this.request("/api/v1/auth/2fa/enable", {
       method: "POST",
       body: JSON.stringify({ code })
-    }, true, false);
+    });
   }
   async disable2fa(password) {
     await this.request("/api/v1/auth/2fa/disable", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   async regenerateBackupCodes() {
-    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" });
   }
   async challenge2fa(request) {
     return this.request("/api/v1/auth/2fa/challenge", {
       method: "POST",
       body: JSON.stringify(request)
-    }, false, false);
+    });
   }
   // ============ Users ============
   async createUser(request) {
@@ -530,7 +525,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -555,7 +550,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -653,11 +648,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    );
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {

package/dist/index.mjs

@@ -4,7 +4,7 @@ import {
   LocalStorageTokenStorage,
   MemoryTokenStorage,
   ScopeError
-} from "./chunk-DMNUO422.mjs";
+} from "./chunk-5NJCXFBV.mjs";
 
 // src/storage/cookie.ts
 var CookieTokenStorage = class _CookieTokenStorage {

package/dist/next.d.mts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.mjs';
 
 interface MiddlewareOptions {
     /** Base URL of Auth Mi service */

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.js';
 
 interface MiddlewareOptions {
     /** Base URL of Auth Mi service */

package/dist/next.js

@@ -4466,8 +4466,6 @@ function resolveConfig(provider) {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
     serviceId: raw.serviceId ?? "",
-    clientId: raw.clientId ?? "",
-    clientSecret: raw.clientSecret ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -4556,7 +4554,7 @@ var AuthMiClient = class {
     return resolveConfig(this.configProvider);
   }
   // ============ HTTP plumbing ============
-  async request(endpoint, options = {}, requireUserToken = false, requireServiceAuth = true) {
+  async request(endpoint, options = {}, requireUserToken = false) {
     const cfg = this.config;
     const url = `${cfg.baseUrl}${endpoint}`;
     const headers = {
@@ -4567,10 +4565,7 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (requireServiceAuth && cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
-        headers["X-Service-ID"] = cfg.serviceId || cfg.clientId;
-      } else if (requireServiceAuth && cfg.apiKey) {
+      } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
     }
@@ -4606,7 +4601,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -4628,7 +4623,7 @@ var AuthMiClient = class {
     const response = await this.request("/api/v1/auth/signup", {
       method: "POST",
       body: JSON.stringify(credentials)
-    }, false, false);
+    });
     return this.mapAuthToken(response);
   }
   async login(credentials) {
@@ -4642,7 +4637,7 @@ var AuthMiClient = class {
         expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
         scopes: credentials.scopes
       })
-    }, false, false);
+    });
     const token = this.mapAuthToken(response);
     this.setAccessToken(token.accessToken);
     return token;
@@ -4678,31 +4673,31 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/forgot-password", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async resetPassword(request) {
     return this.request("/api/v1/auth/reset-password", {
       method: "POST",
       body: JSON.stringify({ token: request.token, new_password: request.newPassword })
-    }, false, false);
+    });
   }
   async verifyEmail(request) {
     return this.request("/api/v1/auth/verify-email", {
       method: "POST",
       body: JSON.stringify({ token: request.token })
-    }, false, false);
+    });
   }
   async resendVerification(request) {
     return this.request("/api/v1/auth/resend-verification", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async deactivateAccount(password) {
     await this.request("/api/v1/auth/deactivate", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   mapAuthToken(raw) {
     return {
@@ -4719,13 +4714,13 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
-    }, false, false);
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
+    });
     return response.url;
   }
   handleOAuthCallback(url) {
@@ -4746,13 +4741,13 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/saml/initiate", {
       method: "POST",
       body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
-    }, false, false);
+    });
   }
   async parseSamlMetadata(xml) {
     return this.request("/api/v1/auth/saml/parse-metadata", {
       method: "POST",
       body: JSON.stringify({ metadata_xml: xml })
-    }, false, false);
+    });
   }
   async listSamlConnections() {
     const response = await this.request("/api/v1/auth/saml/connections");
@@ -4771,28 +4766,28 @@ var AuthMiClient = class {
   }
   // ============ 2FA ============
   async setup2fa() {
-    return this.request("/api/v1/auth/2fa/setup", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" });
   }
   async enable2fa(code) {
     return this.request("/api/v1/auth/2fa/enable", {
       method: "POST",
       body: JSON.stringify({ code })
-    }, true, false);
+    });
   }
   async disable2fa(password) {
     await this.request("/api/v1/auth/2fa/disable", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   async regenerateBackupCodes() {
-    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" });
   }
   async challenge2fa(request) {
     return this.request("/api/v1/auth/2fa/challenge", {
       method: "POST",
       body: JSON.stringify(request)
-    }, false, false);
+    });
   }
   // ============ Users ============
   async createUser(request) {
@@ -4958,7 +4953,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -4983,7 +4978,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -5081,11 +5076,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    );
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {

package/dist/next.mjs

@@ -5,7 +5,7 @@ import {
   __commonJS,
   __require,
   __toESM
-} from "./chunk-DMNUO422.mjs";
+} from "./chunk-5NJCXFBV.mjs";
 
 // ../../node_modules/next/dist/shared/lib/i18n/detect-domain-locale.js
 var require_detect_domain_locale = __commonJS({

package/dist/react.d.mts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-DmZsG2xs.mjs';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.mjs';
+import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-Cj-AA4V9.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.mjs';
 
 interface AuthMiContextValue {
     client: AuthMiClient;

package/dist/react.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-DmZsG2xs.js';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.js';
+import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-Cj-AA4V9.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.js';
 
 interface AuthMiContextValue {
     client: AuthMiClient;

package/dist/react.js

@@ -42,8 +42,6 @@ function resolveConfig(provider) {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
     serviceId: raw.serviceId ?? "",
-    clientId: raw.clientId ?? "",
-    clientSecret: raw.clientSecret ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -132,7 +130,7 @@ var AuthMiClient = class {
     return resolveConfig(this.configProvider);
   }
   // ============ HTTP plumbing ============
-  async request(endpoint, options = {}, requireUserToken = false, requireServiceAuth = true) {
+  async request(endpoint, options = {}, requireUserToken = false) {
     const cfg = this.config;
     const url = `${cfg.baseUrl}${endpoint}`;
     const headers = {
@@ -143,10 +141,7 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (requireServiceAuth && cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
-        headers["X-Service-ID"] = cfg.serviceId || cfg.clientId;
-      } else if (requireServiceAuth && cfg.apiKey) {
+      } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
     }
@@ -182,7 +177,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -204,7 +199,7 @@ var AuthMiClient = class {
     const response = await this.request("/api/v1/auth/signup", {
       method: "POST",
       body: JSON.stringify(credentials)
-    }, false, false);
+    });
     return this.mapAuthToken(response);
   }
   async login(credentials) {
@@ -218,7 +213,7 @@ var AuthMiClient = class {
         expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
         scopes: credentials.scopes
       })
-    }, false, false);
+    });
     const token = this.mapAuthToken(response);
     this.setAccessToken(token.accessToken);
     return token;
@@ -254,31 +249,31 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/forgot-password", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async resetPassword(request) {
     return this.request("/api/v1/auth/reset-password", {
       method: "POST",
       body: JSON.stringify({ token: request.token, new_password: request.newPassword })
-    }, false, false);
+    });
   }
   async verifyEmail(request) {
     return this.request("/api/v1/auth/verify-email", {
       method: "POST",
       body: JSON.stringify({ token: request.token })
-    }, false, false);
+    });
   }
   async resendVerification(request) {
     return this.request("/api/v1/auth/resend-verification", {
       method: "POST",
       body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
-    }, false, false);
+    });
   }
   async deactivateAccount(password) {
     await this.request("/api/v1/auth/deactivate", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   mapAuthToken(raw) {
     return {
@@ -295,13 +290,13 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
-    }, false, false);
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
+    });
     return response.url;
   }
   handleOAuthCallback(url) {
@@ -322,13 +317,13 @@ var AuthMiClient = class {
     return this.request("/api/v1/auth/saml/initiate", {
       method: "POST",
       body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
-    }, false, false);
+    });
   }
   async parseSamlMetadata(xml) {
     return this.request("/api/v1/auth/saml/parse-metadata", {
       method: "POST",
       body: JSON.stringify({ metadata_xml: xml })
-    }, false, false);
+    });
   }
   async listSamlConnections() {
     const response = await this.request("/api/v1/auth/saml/connections");
@@ -347,28 +342,28 @@ var AuthMiClient = class {
   }
   // ============ 2FA ============
   async setup2fa() {
-    return this.request("/api/v1/auth/2fa/setup", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" });
   }
   async enable2fa(code) {
     return this.request("/api/v1/auth/2fa/enable", {
       method: "POST",
       body: JSON.stringify({ code })
-    }, true, false);
+    });
   }
   async disable2fa(password) {
     await this.request("/api/v1/auth/2fa/disable", {
       method: "POST",
       body: JSON.stringify({ password })
-    }, true, false);
+    });
   }
   async regenerateBackupCodes() {
-    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" }, true, false);
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" });
   }
   async challenge2fa(request) {
     return this.request("/api/v1/auth/2fa/challenge", {
       method: "POST",
       body: JSON.stringify(request)
-    }, false, false);
+    });
   }
   // ============ Users ============
   async createUser(request) {
@@ -534,7 +529,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -559,7 +554,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -657,11 +652,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    );
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {
@@ -765,7 +760,7 @@ function AuthMiProvider({
     setIsLoading(true);
     try {
       const cfg = client["config"];
-      const token = await client.signup({ email, password, name, client_id: cfg.serviceId || cfg.clientId });
+      const token = await client.signup({ email, password, name, client_id: cfg.serviceId });
       setIsAuthenticated(true);
       setUser({ userId: token.userId, email: token.email, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
     } finally {

package/dist/react.mjs

@@ -2,7 +2,7 @@ import {
   AuthMiClient,
   AuthMiError,
   ScopeError
-} from "./chunk-DMNUO422.mjs";
+} from "./chunk-5NJCXFBV.mjs";
 
 // src/react.tsx
 import {
@@ -77,7 +77,7 @@ function AuthMiProvider({
     setIsLoading(true);
     try {
       const cfg = client["config"];
-      const token = await client.signup({ email, password, name, client_id: cfg.serviceId || cfg.clientId });
+      const token = await client.signup({ email, password, name, client_id: cfg.serviceId });
       setIsAuthenticated(true);
       setUser({ userId: token.userId, email: token.email, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
     } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authmi",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "Official client library for Auth Mi - Multi-tenant authentication-as-a-service",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",