authmi 1.3.0 → 1.4.0

package/dist/{chunk-LBMBSWSF.mjs → chunk-5NJCXFBV.mjs}

@@ -33,29 +33,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/config.ts
 function resolveConfig(provider) {
   const raw = typeof provider === "function" ? provider() : provider;
-  let clientId = raw.clientId ?? "";
-  let clientSecret = raw.clientSecret ?? "";
-  let serviceId = raw.serviceId ?? "";
-  const token = raw.token ?? "";
-  if (raw.token) {
-    const dot = raw.token.indexOf(".");
-    if (dot > 0) {
-      const sid = raw.token.slice(0, dot);
-      const secret = raw.token.slice(dot + 1);
-      if (sid && secret) {
-        clientId = sid;
-        clientSecret = secret;
-        if (!serviceId) serviceId = sid;
-      }
-    }
-  }
   return {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
-    serviceId,
-    clientId,
-    clientSecret,
-    token,
+    serviceId: raw.serviceId ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -155,8 +136,6 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
       } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
@@ -193,7 +172,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, token: ___, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -306,12 +285,12 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
     });
     return response.url;
   }
@@ -545,7 +524,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -570,7 +549,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -668,23 +647,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
-    return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
-      { method: "POST" }
-    );
-  }
-  /** Get the combined service token — a single string combining serviceId and
-   * clientSecret. Can be passed to `AuthMiClient` as the `token` config option
-   * instead of providing serviceId and clientSecret separately.
-   *
-   * Format returned: "{serviceId}.{clientSecret}"
-   */
-  async getServiceToken(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/token`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    ).then((r) => ({ token: r.token, serviceId: r.service_id, serviceName: r.service_name }));
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {

package/dist/{client-ClqDnphI.d.mts → client-Cj-AA4V9.d.mts}

@@ -5,21 +5,6 @@ interface AuthMiConfig {
     apiKey?: string;
     /** Service ID (svc-xxx) — required for token introspection */
     serviceId?: string;
-    /** Client ID for Basic auth — alternative to apiKey for service-level auth */
-    clientId?: string;
-    /** Client Secret for Basic auth */
-    clientSecret?: string;
-    /**
-     * Combined service token — alternative to providing serviceId+clientSecret
-     * (or clientId+clientSecret) separately.
-     *
-     * Format:  "{serviceId}.{clientSecret}"
-     * Example: "svc-lightssl.cs-a1b2c3d4e5f6..."
-     *
-     * The SDK splits the token on the first '.' to extract the service ID
-     * and the client secret, then uses Basic auth as usual.
-     */
-    token?: string;
     /** Default token expiration in hours (default: 24) */
     defaultTokenExpiry?: number;
 }
@@ -329,7 +314,7 @@ declare class AuthMiClient {
     private get config();
     private request;
     configure(config: Partial<AuthMiConfig>): void;
-    getConfig(): Omit<AuthMiConfig, "apiKey" | "clientSecret" | "token">;
+    getConfig(): Omit<AuthMiConfig, "apiKey">;
     getAccessToken(): Promise<string | null>;
     setAccessToken(token: string): void;
     clearAccessToken(): void;
@@ -406,19 +391,8 @@ declare class AuthMiClient {
     getAuditLogs(query?: AuditLogQuery): Promise<AuditLog[]>;
     getService(serviceId: string): Promise<ServiceDetail>;
     updateService(serviceId: string, data: UpdateServiceRequest): Promise<ServiceDetail>;
-    rotateClientSecret(serviceId: string): Promise<{
-        clientSecret: string;
-    }>;
-    /** Get the combined service token — a single string combining serviceId and
-     * clientSecret. Can be passed to `AuthMiClient` as the `token` config option
-     * instead of providing serviceId and clientSecret separately.
-     *
-     * Format returned: "{serviceId}.{clientSecret}"
-     */
-    getServiceToken(serviceId: string): Promise<{
-        token: string;
-        serviceId: string;
-        serviceName: string;
+    rotateServiceKey(serviceId: string): Promise<{
+        serviceKey: string;
     }>;
     getJwks(serviceId: string): Promise<JwksResponse>;
     onboardService(request: OnboardRequest, masterAdminKey: string): Promise<OnboardResponse>;

package/dist/{client-ClqDnphI.d.ts → client-Cj-AA4V9.d.ts}

@@ -5,21 +5,6 @@ interface AuthMiConfig {
     apiKey?: string;
     /** Service ID (svc-xxx) — required for token introspection */
     serviceId?: string;
-    /** Client ID for Basic auth — alternative to apiKey for service-level auth */
-    clientId?: string;
-    /** Client Secret for Basic auth */
-    clientSecret?: string;
-    /**
-     * Combined service token — alternative to providing serviceId+clientSecret
-     * (or clientId+clientSecret) separately.
-     *
-     * Format:  "{serviceId}.{clientSecret}"
-     * Example: "svc-lightssl.cs-a1b2c3d4e5f6..."
-     *
-     * The SDK splits the token on the first '.' to extract the service ID
-     * and the client secret, then uses Basic auth as usual.
-     */
-    token?: string;
     /** Default token expiration in hours (default: 24) */
     defaultTokenExpiry?: number;
 }
@@ -329,7 +314,7 @@ declare class AuthMiClient {
     private get config();
     private request;
     configure(config: Partial<AuthMiConfig>): void;
-    getConfig(): Omit<AuthMiConfig, "apiKey" | "clientSecret" | "token">;
+    getConfig(): Omit<AuthMiConfig, "apiKey">;
     getAccessToken(): Promise<string | null>;
     setAccessToken(token: string): void;
     clearAccessToken(): void;
@@ -406,19 +391,8 @@ declare class AuthMiClient {
     getAuditLogs(query?: AuditLogQuery): Promise<AuditLog[]>;
     getService(serviceId: string): Promise<ServiceDetail>;
     updateService(serviceId: string, data: UpdateServiceRequest): Promise<ServiceDetail>;
-    rotateClientSecret(serviceId: string): Promise<{
-        clientSecret: string;
-    }>;
-    /** Get the combined service token — a single string combining serviceId and
-     * clientSecret. Can be passed to `AuthMiClient` as the `token` config option
-     * instead of providing serviceId and clientSecret separately.
-     *
-     * Format returned: "{serviceId}.{clientSecret}"
-     */
-    getServiceToken(serviceId: string): Promise<{
-        token: string;
-        serviceId: string;
-        serviceName: string;
+    rotateServiceKey(serviceId: string): Promise<{
+        serviceKey: string;
     }>;
     getJwks(serviceId: string): Promise<JwksResponse>;
     onboardService(request: OnboardRequest, masterAdminKey: string): Promise<OnboardResponse>;

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { T as TokenStorage } from './client-ClqDnphI.mjs';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-ClqDnphI.mjs';
+import { T as TokenStorage } from './client-Cj-AA4V9.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.mjs';
 
 declare class LocalStorageTokenStorage implements TokenStorage {
     private canAccess;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage } from './client-ClqDnphI.js';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-ClqDnphI.js';
+import { T as TokenStorage } from './client-Cj-AA4V9.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.js';
 
 declare class LocalStorageTokenStorage implements TokenStorage {
     private canAccess;

package/dist/index.js

@@ -34,29 +34,10 @@ module.exports = __toCommonJS(index_exports);
 // src/config.ts
 function resolveConfig(provider) {
   const raw = typeof provider === "function" ? provider() : provider;
-  let clientId = raw.clientId ?? "";
-  let clientSecret = raw.clientSecret ?? "";
-  let serviceId = raw.serviceId ?? "";
-  const token = raw.token ?? "";
-  if (raw.token) {
-    const dot = raw.token.indexOf(".");
-    if (dot > 0) {
-      const sid = raw.token.slice(0, dot);
-      const secret = raw.token.slice(dot + 1);
-      if (sid && secret) {
-        clientId = sid;
-        clientSecret = secret;
-        if (!serviceId) serviceId = sid;
-      }
-    }
-  }
   return {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
-    serviceId,
-    clientId,
-    clientSecret,
-    token,
+    serviceId: raw.serviceId ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -156,8 +137,6 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
       } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
@@ -194,7 +173,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, token: ___, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -307,12 +286,12 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
     });
     return response.url;
   }
@@ -546,7 +525,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -571,7 +550,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -669,23 +648,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
-    return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
-      { method: "POST" }
-    );
-  }
-  /** Get the combined service token — a single string combining serviceId and
-   * clientSecret. Can be passed to `AuthMiClient` as the `token` config option
-   * instead of providing serviceId and clientSecret separately.
-   *
-   * Format returned: "{serviceId}.{clientSecret}"
-   */
-  async getServiceToken(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/token`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    ).then((r) => ({ token: r.token, serviceId: r.service_id, serviceName: r.service_name }));
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {

package/dist/index.mjs

@@ -4,7 +4,7 @@ import {
   LocalStorageTokenStorage,
   MemoryTokenStorage,
   ScopeError
-} from "./chunk-LBMBSWSF.mjs";
+} from "./chunk-5NJCXFBV.mjs";
 
 // src/storage/cookie.ts
 var CookieTokenStorage = class _CookieTokenStorage {

package/dist/next.d.mts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-ClqDnphI.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.mjs';
 
 interface MiddlewareOptions {
     /** Base URL of Auth Mi service */

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-ClqDnphI.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.js';
 
 interface MiddlewareOptions {
     /** Base URL of Auth Mi service */

package/dist/next.js

@@ -4462,29 +4462,10 @@ var import_server = __toESM(require_server());
 // src/config.ts
 function resolveConfig(provider) {
   const raw = typeof provider === "function" ? provider() : provider;
-  let clientId = raw.clientId ?? "";
-  let clientSecret = raw.clientSecret ?? "";
-  let serviceId = raw.serviceId ?? "";
-  const token = raw.token ?? "";
-  if (raw.token) {
-    const dot = raw.token.indexOf(".");
-    if (dot > 0) {
-      const sid = raw.token.slice(0, dot);
-      const secret = raw.token.slice(dot + 1);
-      if (sid && secret) {
-        clientId = sid;
-        clientSecret = secret;
-        if (!serviceId) serviceId = sid;
-      }
-    }
-  }
   return {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
-    serviceId,
-    clientId,
-    clientSecret,
-    token,
+    serviceId: raw.serviceId ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -4584,8 +4565,6 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
       } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
@@ -4622,7 +4601,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, token: ___, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -4735,12 +4714,12 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
     });
     return response.url;
   }
@@ -4974,7 +4953,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -4999,7 +4978,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -5097,23 +5076,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
-    return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
-      { method: "POST" }
-    );
-  }
-  /** Get the combined service token — a single string combining serviceId and
-   * clientSecret. Can be passed to `AuthMiClient` as the `token` config option
-   * instead of providing serviceId and clientSecret separately.
-   *
-   * Format returned: "{serviceId}.{clientSecret}"
-   */
-  async getServiceToken(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/token`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    ).then((r) => ({ token: r.token, serviceId: r.service_id, serviceName: r.service_name }));
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {

package/dist/next.mjs

@@ -5,7 +5,7 @@ import {
   __commonJS,
   __require,
   __toESM
-} from "./chunk-LBMBSWSF.mjs";
+} from "./chunk-5NJCXFBV.mjs";
 
 // ../../node_modules/next/dist/shared/lib/i18n/detect-domain-locale.js
 var require_detect_domain_locale = __commonJS({

package/dist/react.d.mts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-ClqDnphI.mjs';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-ClqDnphI.mjs';
+import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-Cj-AA4V9.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.mjs';
 
 interface AuthMiContextValue {
     client: AuthMiClient;

package/dist/react.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-ClqDnphI.js';
-export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-ClqDnphI.js';
+import { i as ConfigProvider, h as ClientOptions, G as Setup2FAResult, E as Enable2FAResult, B as BackupCodesResult, C as Challenge2FARequest, f as AuthToken, s as OAuthProvider, c as AuthMiClient, M as User, V as ValidationResult, O as OAuthCallbackResult } from './client-Cj-AA4V9.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, d as AuthMiConfig, e as AuthMiError, g as CheckoutResponse, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, F as ForgotPasswordRequest, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, r as OAuthInitiateResponse, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, N as VerifyEmailRequest, W as Webhook } from './client-Cj-AA4V9.js';
 
 interface AuthMiContextValue {
     client: AuthMiClient;

package/dist/react.js

@@ -38,29 +38,10 @@ var import_react = require("react");
 // src/config.ts
 function resolveConfig(provider) {
   const raw = typeof provider === "function" ? provider() : provider;
-  let clientId = raw.clientId ?? "";
-  let clientSecret = raw.clientSecret ?? "";
-  let serviceId = raw.serviceId ?? "";
-  const token = raw.token ?? "";
-  if (raw.token) {
-    const dot = raw.token.indexOf(".");
-    if (dot > 0) {
-      const sid = raw.token.slice(0, dot);
-      const secret = raw.token.slice(dot + 1);
-      if (sid && secret) {
-        clientId = sid;
-        clientSecret = secret;
-        if (!serviceId) serviceId = sid;
-      }
-    }
-  }
   return {
     baseUrl: raw.baseUrl,
     apiKey: raw.apiKey ?? "",
-    serviceId,
-    clientId,
-    clientSecret,
-    token,
+    serviceId: raw.serviceId ?? "",
     defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
   };
 }
@@ -160,8 +141,6 @@ var AuthMiClient = class {
       if (requireUserToken) {
         const token = await this.storage.getToken();
         if (token) headers["Authorization"] = `Bearer ${token}`;
-      } else if (cfg.clientId && cfg.clientSecret) {
-        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
       } else if (cfg.apiKey) {
         headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
@@ -198,7 +177,7 @@ var AuthMiClient = class {
     this.configProvider = { ...current, ...config };
   }
   getConfig() {
-    const { apiKey: _, clientSecret: __, token: ___, ...rest } = resolveConfig(this.configProvider);
+    const { apiKey: _, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
@@ -311,12 +290,12 @@ var AuthMiClient = class {
   // ============ OAuth ============
   async initiateOAuth(provider, redirectUri) {
     const cfg = this.config;
-    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+    if (!cfg.apiKey) {
       throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
     }
     const response = await this.request("/api/v1/auth/oauth/initiate", {
       method: "POST",
-      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId })
     });
     return response.url;
   }
@@ -550,7 +529,7 @@ var AuthMiClient = class {
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token stored" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token });
       return {
@@ -575,7 +554,7 @@ var AuthMiClient = class {
     const cfg = this.config;
     const token = await this.storage.getToken();
     if (!token) return { valid: false, error: "No token provided" };
-    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.apiKey) return { valid: false, error: "Service credentials not configured" };
     if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
     try {
       const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
@@ -673,23 +652,11 @@ var AuthMiClient = class {
       body: JSON.stringify(data)
     });
   }
-  async rotateClientSecret(serviceId) {
-    return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
-      { method: "POST" }
-    );
-  }
-  /** Get the combined service token — a single string combining serviceId and
-   * clientSecret. Can be passed to `AuthMiClient` as the `token` config option
-   * instead of providing serviceId and clientSecret separately.
-   *
-   * Format returned: "{serviceId}.{clientSecret}"
-   */
-  async getServiceToken(serviceId) {
+  async rotateServiceKey(serviceId) {
     return this.request(
-      `/api/v1/services/${encodeURIComponent(serviceId)}/token`,
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-key`,
       { method: "POST" }
-    ).then((r) => ({ token: r.token, serviceId: r.service_id, serviceName: r.service_name }));
+    ).then((r) => ({ serviceKey: r.service_key }));
   }
   // ============ JWKS ============
   async getJwks(serviceId) {
@@ -793,7 +760,7 @@ function AuthMiProvider({
     setIsLoading(true);
     try {
       const cfg = client["config"];
-      const token = await client.signup({ email, password, name, client_id: cfg.serviceId || cfg.clientId });
+      const token = await client.signup({ email, password, name, client_id: cfg.serviceId });
       setIsAuthenticated(true);
       setUser({ userId: token.userId, email: token.email, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
     } finally {

package/dist/react.mjs

@@ -2,7 +2,7 @@ import {
   AuthMiClient,
   AuthMiError,
   ScopeError
-} from "./chunk-LBMBSWSF.mjs";
+} from "./chunk-5NJCXFBV.mjs";
 
 // src/react.tsx
 import {
@@ -77,7 +77,7 @@ function AuthMiProvider({
     setIsLoading(true);
     try {
       const cfg = client["config"];
-      const token = await client.signup({ email, password, name, client_id: cfg.serviceId || cfg.clientId });
+      const token = await client.signup({ email, password, name, client_id: cfg.serviceId });
       setIsAuthenticated(true);
       setUser({ userId: token.userId, email: token.email, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
     } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "authmi",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Official client library for Auth Mi - Multi-tenant authentication-as-a-service",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",