reqkey 0.2.0__tar.gz → 0.2.1__tar.gz

{reqkey-0.2.0 → reqkey-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: reqkey
-Version: 0.2.0
+Version: 0.2.1
 Summary: The official Python SDK for ReqKey API key validation and usage analytics
 Project-URL: Homepage, https://reqkey.com
 Project-URL: Documentation, https://reqkey.com/docs
@@ -551,6 +551,8 @@ Metadata sent by default:
 - response status
 - endpoint processing latency
 - user agent
+- the consumer API key in the dedicated `apiKey` field, so ReqKey can resolve
+  the internal consumer name
 - `consumerName` when a resolver supplies one
 
 Additional data is opt-in:
@@ -574,9 +576,11 @@ app.add_middleware(
 ```
 
 Authorization, cookies, `Set-Cookie`, common API-key headers, and the configured
-consumer-key header are always removed from captured headers. Response-body
-capture is limited to textual content and a hard maximum of 1,000 characters.
-The limit is enforced again by the HTTP client before `/ingest` is called.
+consumer-key header are always removed from captured headers and paths. The
+middleware sends the extracted consumer key only through `/ingest`'s dedicated
+`apiKey` field for consumer resolution. Response-body capture is limited to
+textual content and a hard maximum of 1,000 characters. The limit is enforced
+again by the HTTP client before `/ingest` is called.
 
 ### Consumer names
 
@@ -600,8 +604,18 @@ app.add_middleware(
 )
 ```
 
-The resolved value is sent as analytics metadata. It is not used as the
-consumer API key and does not change authorization.
+The resolved value is optional analytics metadata. It is not used as the
+consumer API key and does not change authorization. ReqKey resolves the
+consumer display name in this order:
+
+1. A non-empty `consumerName` supplied by the resolver.
+2. The middleware's extracted consumer key, sent as `apiKey` for an internal
+   consumer lookup.
+3. A `consumerId` supplied to the direct client.
+
+No resolver is required for normal ReqKey-managed consumers. The middleware
+still sends the validation `requestId` for log correlation, but `/ingest` does
+not use it to resolve consumer identity.
 
 For Django, set `CONSUMER_NAME_RESOLVER` in `REQKEY`. For WSGI, the resolver
 receives the WSGI environment, so a header can be read as
@@ -767,7 +781,7 @@ with ReqKey(project_key=os.environ["REQKEY_PROJECT_KEY"]) as reqkey:
     decision = reqkey.verify("consumer_key_...", api_id="api_payments")
 ```
 
-Direct ingestion also accepts an optional consumer label:
+Direct ingestion accepts the same consumer identity inputs as `/ingest`:
 
 ```python
 reqkey.ingest(
@@ -776,7 +790,9 @@ reqkey.ingest(
     method="POST",
     path="/payments",
     status_code=201,
-    consumer_name="rapidapi-user",
+    api_key="consumer_key_...",  # resolves the internal consumer name
+    # consumer_name="rapidapi-user",  # optional explicit override
+    # consumer_id="consumer_...",     # fallback when no API key is available
 )
 ```
 

{reqkey-0.2.0 → reqkey-0.2.1}/README.md

@@ -478,6 +478,8 @@ Metadata sent by default:
 - response status
 - endpoint processing latency
 - user agent
+- the consumer API key in the dedicated `apiKey` field, so ReqKey can resolve
+  the internal consumer name
 - `consumerName` when a resolver supplies one
 
 Additional data is opt-in:
@@ -501,9 +503,11 @@ app.add_middleware(
 ```
 
 Authorization, cookies, `Set-Cookie`, common API-key headers, and the configured
-consumer-key header are always removed from captured headers. Response-body
-capture is limited to textual content and a hard maximum of 1,000 characters.
-The limit is enforced again by the HTTP client before `/ingest` is called.
+consumer-key header are always removed from captured headers and paths. The
+middleware sends the extracted consumer key only through `/ingest`'s dedicated
+`apiKey` field for consumer resolution. Response-body capture is limited to
+textual content and a hard maximum of 1,000 characters. The limit is enforced
+again by the HTTP client before `/ingest` is called.
 
 ### Consumer names
 
@@ -527,8 +531,18 @@ app.add_middleware(
 )
 ```
 
-The resolved value is sent as analytics metadata. It is not used as the
-consumer API key and does not change authorization.
+The resolved value is optional analytics metadata. It is not used as the
+consumer API key and does not change authorization. ReqKey resolves the
+consumer display name in this order:
+
+1. A non-empty `consumerName` supplied by the resolver.
+2. The middleware's extracted consumer key, sent as `apiKey` for an internal
+   consumer lookup.
+3. A `consumerId` supplied to the direct client.
+
+No resolver is required for normal ReqKey-managed consumers. The middleware
+still sends the validation `requestId` for log correlation, but `/ingest` does
+not use it to resolve consumer identity.
 
 For Django, set `CONSUMER_NAME_RESOLVER` in `REQKEY`. For WSGI, the resolver
 receives the WSGI environment, so a header can be read as
@@ -694,7 +708,7 @@ with ReqKey(project_key=os.environ["REQKEY_PROJECT_KEY"]) as reqkey:
     decision = reqkey.verify("consumer_key_...", api_id="api_payments")
 ```
 
-Direct ingestion also accepts an optional consumer label:
+Direct ingestion accepts the same consumer identity inputs as `/ingest`:
 
 ```python
 reqkey.ingest(
@@ -703,7 +717,9 @@ reqkey.ingest(
     method="POST",
     path="/payments",
     status_code=201,
-    consumer_name="rapidapi-user",
+    api_key="consumer_key_...",  # resolves the internal consumer name
+    # consumer_name="rapidapi-user",  # optional explicit override
+    # consumer_id="consumer_...",     # fallback when no API key is available
 )
 ```
 

{reqkey-0.2.0 → reqkey-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "reqkey"
-version = "0.2.0"
+version = "0.2.1"
 description = "The official Python SDK for ReqKey API key validation and usage analytics"
 readme = "README.md"
 requires-python = ">=3.10"

{reqkey-0.2.0 → reqkey-0.2.1}/src/reqkey/__init__.py

@@ -11,7 +11,7 @@ from .exceptions import (
 )
 from .models import MiddlewareErrorEvent, VerificationReason, VerificationResult
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 __all__ = [
     "AsyncReqKey",

{reqkey-0.2.0 → reqkey-0.2.1}/src/reqkey/asgi.py

@@ -135,6 +135,8 @@ class AsyncReqKeyLike(Protocol):
         user_agent: str | None = None,
         user_id: str | None = None,
         consumer_name: str | None = None,
+        api_key: str | None = None,
+        consumer_id: str | None = None,
         query_params: Mapping[str, Any] | None = None,
         request_headers: Mapping[str, str] | None = None,
         response_headers: Mapping[str, str] | None = None,
@@ -276,13 +278,14 @@ class ReqKeyMiddleware:
         request_started = time.perf_counter()
         decision: VerificationResult | None = None
         validation_time_ms: float | None = None
+        consumer_key = await self._consumer_key(request)
 
         if self.mode in {"validate", "both"}:
-            consumer_key = await self._consumer_key(request)
             if consumer_key is None:
                 await self._ingest_denied_request(
                     request,
                     decision=None,
+                    consumer_key=None,
                     status_code=401,
                     error="missing_api_key",
                     headers={},
@@ -336,6 +339,7 @@ class ReqKeyMiddleware:
                 await self._ingest_denied_request(
                     request,
                     decision=decision,
+                    consumer_key=consumer_key,
                     status_code=status_code,
                     error=error,
                     headers=headers,
@@ -372,6 +376,7 @@ class ReqKeyMiddleware:
             receive,
             send,
             decision=decision,
+            consumer_key=consumer_key,
             validation_time_ms=validation_time_ms,
         )
 
@@ -398,6 +403,7 @@ class ReqKeyMiddleware:
         send: Send,
         *,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         validation_time_ms: float | None,
     ) -> None:
         response_status = 500
@@ -431,6 +437,7 @@ class ReqKeyMiddleware:
             await self._ingest_safely(
                 request=request,
                 decision=decision,
+                consumer_key=consumer_key,
                 response_status=response_status,
                 latency_ms=round((time.perf_counter() - started) * 1000),
                 response_headers=response_headers,
@@ -446,6 +453,7 @@ class ReqKeyMiddleware:
                 await self._ingest_safely(
                     request=request,
                     decision=decision,
+                    consumer_key=consumer_key,
                     response_status=500,
                     latency_ms=round((time.perf_counter() - started) * 1000),
                     response_headers=response_headers,
@@ -457,6 +465,7 @@ class ReqKeyMiddleware:
             await self._ingest_safely(
                 request=request,
                 decision=decision,
+                consumer_key=consumer_key,
                 response_status=response_status,
                 latency_ms=round((time.perf_counter() - started) * 1000),
                 response_headers=response_headers,
@@ -537,6 +546,7 @@ class ReqKeyMiddleware:
         *,
         request: Request,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         response_status: int,
         latency_ms: int,
         response_headers: Headers,
@@ -572,6 +582,7 @@ class ReqKeyMiddleware:
                 client_ip=client_ip,
                 user_agent=user_agent,
                 consumer_name=consumer_name,
+                api_key=consumer_key,
                 query_params=query_params,
                 request_headers=request_headers,
                 response_headers=captured_response_headers,
@@ -592,6 +603,7 @@ class ReqKeyMiddleware:
         request: Request,
         *,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         status_code: int,
         error: str,
         headers: Mapping[str, str],
@@ -617,6 +629,7 @@ class ReqKeyMiddleware:
         await self._ingest_safely(
             request=request,
             decision=decision,
+            consumer_key=consumer_key,
             response_status=status_code,
             latency_ms=round((time.perf_counter() - started) * 1000),
             response_headers=response_headers,

{reqkey-0.2.0 → reqkey-0.2.1}/src/reqkey/client.py

@@ -20,7 +20,7 @@ from .models import VerificationReason, VerificationResult
 
 DEFAULT_BASE_URL = "https://api.reqkey.com"
 DEFAULT_TIMEOUT_SECONDS = 2.0
-USER_AGENT = "reqkey-python/0.2.0"
+USER_AGENT = "reqkey-python/0.2.1"
 MAX_BODY_CHARACTERS = 1000
 _DECISION_STATUS_CODES = {200, 402, 403, 429}
 
@@ -168,6 +168,8 @@ def _ingest_payload(
     user_agent: str | None = None,
     user_id: str | None = None,
     consumer_name: str | None = None,
+    api_key: str | None = None,
+    consumer_id: str | None = None,
     query_params: Mapping[str, Any] | None = None,
     request_headers: Mapping[str, str] | None = None,
     response_headers: Mapping[str, str] | None = None,
@@ -196,6 +198,8 @@ def _ingest_payload(
         "userAgent": user_agent,
         "userId": user_id,
         "consumerName": consumer_name,
+        "apiKey": api_key,
+        "consumerId": consumer_id,
         "queryParams": dict(query_params) if query_params is not None else None,
         "requestHeaders": dict(request_headers) if request_headers is not None else None,
         "responseHeaders": dict(response_headers) if response_headers is not None else None,
@@ -297,6 +301,8 @@ class ReqKey:
         user_agent: str | None = None,
         user_id: str | None = None,
         consumer_name: str | None = None,
+        api_key: str | None = None,
+        consumer_id: str | None = None,
         query_params: Mapping[str, Any] | None = None,
         request_headers: Mapping[str, str] | None = None,
         response_headers: Mapping[str, str] | None = None,
@@ -318,6 +324,8 @@ class ReqKey:
             user_agent=user_agent,
             user_id=user_id,
             consumer_name=consumer_name,
+            api_key=api_key,
+            consumer_id=consumer_id,
             query_params=query_params,
             request_headers=request_headers,
             response_headers=response_headers,
@@ -418,6 +426,8 @@ class AsyncReqKey:
         user_agent: str | None = None,
         user_id: str | None = None,
         consumer_name: str | None = None,
+        api_key: str | None = None,
+        consumer_id: str | None = None,
         query_params: Mapping[str, Any] | None = None,
         request_headers: Mapping[str, str] | None = None,
         response_headers: Mapping[str, str] | None = None,
@@ -439,6 +449,8 @@ class AsyncReqKey:
             user_agent=user_agent,
             user_id=user_id,
             consumer_name=consumer_name,
+            api_key=api_key,
+            consumer_id=consumer_id,
             query_params=query_params,
             request_headers=request_headers,
             response_headers=response_headers,

{reqkey-0.2.0 → reqkey-0.2.1}/src/reqkey/django.py

@@ -67,6 +67,8 @@ class SyncReqKeyLike(Protocol):
         user_agent: str | None = None,
         user_id: str | None = None,
         consumer_name: str | None = None,
+        api_key: str | None = None,
+        consumer_id: str | None = None,
         query_params: Mapping[str, Any] | None = None,
         request_headers: Mapping[str, str] | None = None,
         response_headers: Mapping[str, str] | None = None,
@@ -100,6 +102,8 @@ class AsyncReqKeyLike(Protocol):
         user_agent: str | None = None,
         user_id: str | None = None,
         consumer_name: str | None = None,
+        api_key: str | None = None,
+        consumer_id: str | None = None,
         query_params: Mapping[str, Any] | None = None,
         request_headers: Mapping[str, str] | None = None,
         response_headers: Mapping[str, str] | None = None,
@@ -245,9 +249,9 @@ class ReqKeyMiddleware:
         decision: VerificationResult | None = None
         validation_time_ms: float | None = None
         client = cast(SyncReqKeyLike, self.client)
+        consumer_key = self._consumer_key_sync(request)
 
         if self.mode in {"validate", "both"}:
-            consumer_key = self._consumer_key_sync(request)
             if consumer_key is None:
                 missing_response = self._respond(401, "missing_api_key")
                 if self.mode == "both" and self.ingest_denied_requests:
@@ -255,6 +259,7 @@ class ReqKeyMiddleware:
                         client,
                         request=request,
                         decision=None,
+                        consumer_key=None,
                         response=missing_response,
                         status_code=401,
                         latency_ms=round(
@@ -294,6 +299,7 @@ class ReqKeyMiddleware:
                         client,
                         request=request,
                         decision=decision,
+                        consumer_key=consumer_key,
                         response=denied,
                         status_code=denied.status_code,
                         latency_ms=round(
@@ -312,6 +318,7 @@ class ReqKeyMiddleware:
                     client,
                     request=request,
                     decision=decision,
+                    consumer_key=consumer_key,
                     response=None,
                     status_code=500,
                     latency_ms=round((time.perf_counter() - started) * 1000),
@@ -323,6 +330,7 @@ class ReqKeyMiddleware:
                 client,
                 request=request,
                 decision=decision,
+                consumer_key=consumer_key,
                 response=response,
                 status_code=response.status_code,
                 latency_ms=round((time.perf_counter() - started) * 1000),
@@ -338,9 +346,9 @@ class ReqKeyMiddleware:
         decision: VerificationResult | None = None
         validation_time_ms: float | None = None
         client = cast(AsyncReqKeyLike, self.client)
+        consumer_key = await self._consumer_key_async(request)
 
         if self.mode in {"validate", "both"}:
-            consumer_key = await self._consumer_key_async(request)
             if consumer_key is None:
                 missing_response = self._respond(401, "missing_api_key")
                 if self.mode == "both" and self.ingest_denied_requests:
@@ -348,6 +356,7 @@ class ReqKeyMiddleware:
                         client,
                         request=request,
                         decision=None,
+                        consumer_key=None,
                         response=missing_response,
                         status_code=401,
                         latency_ms=round(
@@ -387,6 +396,7 @@ class ReqKeyMiddleware:
                         client,
                         request=request,
                         decision=decision,
+                        consumer_key=consumer_key,
                         response=denied,
                         status_code=denied.status_code,
                         latency_ms=round(
@@ -405,6 +415,7 @@ class ReqKeyMiddleware:
                     client,
                     request=request,
                     decision=decision,
+                    consumer_key=consumer_key,
                     response=None,
                     status_code=500,
                     latency_ms=round((time.perf_counter() - started) * 1000),
@@ -416,6 +427,7 @@ class ReqKeyMiddleware:
                 client,
                 request=request,
                 decision=decision,
+                consumer_key=consumer_key,
                 response=response,
                 status_code=response.status_code,
                 latency_ms=round((time.perf_counter() - started) * 1000),
@@ -508,6 +520,7 @@ class ReqKeyMiddleware:
         *,
         request: HttpRequest,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         response: HttpResponseBase | None,
         status_code: int,
         latency_ms: int,
@@ -524,6 +537,7 @@ class ReqKeyMiddleware:
                     self._resource_path_sync(request),
                     self._client_ip_sync(request),
                     self._consumer_name_sync(request),
+                    consumer_key,
                 ),
             )
         except ReqKeyError as exc:
@@ -542,6 +556,7 @@ class ReqKeyMiddleware:
         *,
         request: HttpRequest,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         response: HttpResponseBase | None,
         status_code: int,
         latency_ms: int,
@@ -558,6 +573,7 @@ class ReqKeyMiddleware:
                     await self._resource_path_async(request),
                     await self._client_ip_async(request),
                     await self._consumer_name_async(request),
+                    consumer_key,
                 ),
             )
         except ReqKeyError as exc:
@@ -579,6 +595,7 @@ class ReqKeyMiddleware:
         resource_path: str,
         client_ip: str | None,
         consumer_name: str | None,
+        consumer_key: str | None,
     ) -> dict[str, Any]:
         query_params, query = self._captured_query(request)
         request_headers = dict(request.headers.items())
@@ -596,6 +613,7 @@ class ReqKeyMiddleware:
             ),
             "query_params": query_params,
             "consumer_name": consumer_name,
+            "api_key": consumer_key,
             "request_headers": (
                 filtered_headers(request_headers, self.excluded_headers)
                 if self.capture_request_headers

{reqkey-0.2.0 → reqkey-0.2.1}/src/reqkey/wsgi.py

@@ -84,6 +84,8 @@ class ReqKeyLike(Protocol):
         user_agent: str | None = None,
         user_id: str | None = None,
         consumer_name: str | None = None,
+        api_key: str | None = None,
+        consumer_id: str | None = None,
         query_params: Mapping[str, Any] | None = None,
         request_headers: Mapping[str, str] | None = None,
         response_headers: Mapping[str, str] | None = None,
@@ -255,13 +257,14 @@ class ReqKeyMiddleware:
         request_started = time.perf_counter()
         decision: VerificationResult | None = None
         validation_time_ms: float | None = None
+        consumer_key = self._consumer_key(environ)
 
         if self.mode in {"validate", "both"}:
-            consumer_key = self._consumer_key(environ)
             if consumer_key is None:
                 self._ingest_denied_safely(
                     environ,
                     decision=None,
+                    consumer_key=None,
                     status_code=401,
                     error="missing_api_key",
                     headers={},
@@ -301,6 +304,7 @@ class ReqKeyMiddleware:
                 self._ingest_denied_safely(
                     environ,
                     decision=decision,
+                    consumer_key=consumer_key,
                     status_code=status_code,
                     error=error,
                     headers=headers,
@@ -321,6 +325,7 @@ class ReqKeyMiddleware:
             environ,
             wrapped_start,
             decision=decision,
+            consumer_key=consumer_key,
         )
 
     def _run_with_ingest(
@@ -329,6 +334,7 @@ class ReqKeyMiddleware:
         start_response: StartResponse,
         *,
         decision: VerificationResult | None,
+        consumer_key: str | None,
     ) -> Iterator[bytes]:
         response = _ResponseState()
         started = time.perf_counter()
@@ -372,6 +378,7 @@ class ReqKeyMiddleware:
             self._ingest_safely(
                 environ=environ,
                 decision=decision,
+                consumer_key=consumer_key,
                 response_status=500 if failed else response.status_code,
                 latency_ms=round((time.perf_counter() - started) * 1000),
                 response_headers=response.headers,
@@ -431,6 +438,7 @@ class ReqKeyMiddleware:
         *,
         environ: WSGIEnvironment,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         response_status: int,
         latency_ms: int,
         response_headers: Mapping[str, str],
@@ -456,6 +464,7 @@ class ReqKeyMiddleware:
                     request_headers.get("user-agent") if self.capture_user_agent else None
                 ),
                 consumer_name=self._consumer_name(environ),
+                api_key=consumer_key,
                 query_params=query_params,
                 request_headers=(
                     filtered_headers(request_headers, self.excluded_headers)
@@ -484,6 +493,7 @@ class ReqKeyMiddleware:
         environ: WSGIEnvironment,
         *,
         decision: VerificationResult | None,
+        consumer_key: str | None,
         status_code: int,
         error: str,
         headers: Mapping[str, str],
@@ -498,6 +508,7 @@ class ReqKeyMiddleware:
         self._ingest_safely(
             environ=environ,
             decision=decision,
+            consumer_key=consumer_key,
             response_status=status_code,
             latency_ms=round((time.perf_counter() - started) * 1000),
             response_headers=response_headers,

{reqkey-0.2.0 → reqkey-0.2.1}/tests/test_client.py

@@ -128,6 +128,8 @@ async def test_async_ingest_uses_request_id_and_truncates_bodies() -> None:
         method="POST",
         endpoint="/payments",
         consumer_name="rapidapi-user",
+        api_key="prod_consumer",
+        consumer_id="consumer_123",
         response_body="x" * 1200,
     )
     await http_client.aclose()
@@ -135,6 +137,8 @@ async def test_async_ingest_uses_request_id_and_truncates_bodies() -> None:
     assert captured["requestId"] == "request_123"
     assert captured["method"] == "POST"
     assert captured["consumerName"] == "rapidapi-user"
+    assert captured["apiKey"] == "prod_consumer"
+    assert captured["consumerId"] == "consumer_123"
     assert len(str(captured["responseBody"])) == 1000
 
 

{reqkey-0.2.0 → reqkey-0.2.1}/tests/test_django.py

@@ -170,6 +170,7 @@ def test_django_sync_middleware_validates_attaches_state_and_ingests() -> None:
     }
     event = fake.ingest_calls[0]
     assert event["request_id"] == "request_123"
+    assert event["api_key"] == "prod_consumer"
     assert event["path"] == "/protected?page=2"
     assert event["query_params"] == {"page": "2"}
     assert event["request_headers"]["X-Safe"] == "visible"
@@ -196,6 +197,7 @@ def test_django_missing_key_short_circuits_before_view() -> None:
     assert called is False
     assert fake.verify_calls == []
     assert fake.ingest_calls[0]["request_id"] is None
+    assert fake.ingest_calls[0]["api_key"] is None
     assert fake.ingest_calls[0]["status_code"] == 401
     assert fake.ingest_calls[0]["path"] == "/protected"
 
@@ -217,6 +219,7 @@ def test_django_rate_limit_preserves_retry_after_and_skips_view() -> None:
     assert json.loads(response.content)["error"] == "rate_limited"
     assert fake.ingest_calls[0]["request_id"] == "request_limited"
     assert fake.ingest_calls[0]["status_code"] == 429
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
 
 
 def test_django_resolves_consumer_name_and_client_ip() -> None:
@@ -243,6 +246,7 @@ def test_django_resolves_consumer_name_and_client_ip() -> None:
 
     assert response.status_code == 200
     assert fake.ingest_calls[0]["consumer_name"] == "rapidapi-user"
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
     assert fake.ingest_calls[0]["client_ip"] == "203.0.113.30"
 
 
@@ -306,7 +310,7 @@ def test_django_reports_validation_and_ingestion_errors() -> None:
     assert ingest_events[0].request_id == "request_123"
 
 
-def test_django_query_key_is_redacted_from_analytics() -> None:
+def test_django_query_key_is_redacted_from_path_but_ingested_as_identity() -> None:
     fake = FakeSyncReqKey(allowed_result())
 
     with override_settings(
@@ -327,7 +331,7 @@ def test_django_query_key_is_redacted_from_analytics() -> None:
     event = fake.ingest_calls[0]
     assert event["query_params"] == {"page": "2"}
     assert event["path"] == "/protected?page=2"
-    assert "prod_secret" not in str(event)
+    assert event["api_key"] == "prod_secret"
 
 
 def test_django_fail_open_exposes_error_and_continues() -> None:
@@ -371,6 +375,7 @@ async def test_django_async_middleware_uses_async_client_without_adaptation() ->
     assert response.status_code == 200
     assert fake.verify_calls[0]["key"] == "prod_consumer"
     assert fake.ingest_calls[0]["request_id"] == "request_123"
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
 
 
 @pytest.mark.asyncio
@@ -410,6 +415,7 @@ async def test_django_async_denial_uses_async_resolvers_and_ingests() -> None:
     assert fake.ingest_calls[0]["request_id"] == "request_limited"
     assert fake.ingest_calls[0]["status_code"] == 429
     assert fake.ingest_calls[0]["consumer_name"] == "rapidapi-user"
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
     assert fake.ingest_calls[0]["client_ip"] == "203.0.113.40"
 
 
@@ -449,3 +455,4 @@ def test_django_ingest_only_mode_does_not_require_consumer_key() -> None:
     assert response.status_code == 200
     assert fake.verify_calls == []
     assert fake.ingest_calls[0]["api_id"] == "payments"
+    assert fake.ingest_calls[0]["api_key"] is None

{reqkey-0.2.0 → reqkey-0.2.1}/tests/test_fastapi.py

@@ -129,6 +129,7 @@ def test_both_mode_gates_then_records_correlated_metadata() -> None:
     ]
     assert fake.ingest_calls[0]["request_id"] == "request_123"
     assert fake.ingest_calls[0]["api_id"] == "payments"
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
     assert fake.ingest_calls[0]["path"] == "/protected"
     assert fake.ingest_calls[0]["query_params"] is None
 
@@ -152,6 +153,7 @@ def test_ingest_mode_does_not_require_or_validate_a_consumer_key() -> None:
     assert fake.verify_calls == []
     assert fake.ingest_calls[0]["request_id"] is None
     assert fake.ingest_calls[0]["api_id"] == "payments"
+    assert fake.ingest_calls[0]["api_key"] is None
 
 
 def test_missing_key_is_denied_before_handler() -> None:
@@ -163,6 +165,7 @@ def test_missing_key_is_denied_before_handler() -> None:
     assert response.json()["error"] == "missing_api_key"
     assert fake.verify_calls == []
     assert fake.ingest_calls[0]["request_id"] is None
+    assert fake.ingest_calls[0]["api_key"] is None
     assert fake.ingest_calls[0]["status_code"] == 401
     assert fake.ingest_calls[0]["path"] == "/protected"
 
@@ -198,6 +201,7 @@ def test_rate_limit_preserves_retry_after() -> None:
     assert response.status_code == 429
     assert response.headers["Retry-After"] == "4"
     assert fake.ingest_calls[0]["status_code"] == 429
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
 
 
 def test_denied_ingestion_can_be_disabled() -> None:
@@ -268,7 +272,7 @@ def test_query_parameter_key_and_custom_header_name() -> None:
     assert fake.verify_calls[0]["key"] == "prod_consumer"
 
 
-def test_query_parameter_consumer_key_is_never_ingested() -> None:
+def test_query_parameter_consumer_key_is_only_ingested_as_identity() -> None:
     fake = FakeReqKey(allowed_result())
     with TestClient(
         make_app(
@@ -283,7 +287,7 @@ def test_query_parameter_consumer_key_is_never_ingested() -> None:
     assert response.status_code == 200
     assert fake.ingest_calls[0]["query_params"] == {"page": "2"}
     assert fake.ingest_calls[0]["path"] == "/protected?page=2"
-    assert "prod_secret" not in str(fake.ingest_calls[0])
+    assert fake.ingest_calls[0]["api_key"] == "prod_secret"
 
 
 def test_capture_options_redact_consumer_key_and_capture_response() -> None:
@@ -308,6 +312,7 @@ def test_capture_options_redact_consumer_key_and_capture_response() -> None:
     assert event["path"] == "/protected?page=2"
     assert event["request_headers"]["x-safe"] == "visible"
     assert "x-api-key" not in event["request_headers"]
+    assert event["api_key"] == "prod_consumer"
     assert event["response_headers"]["content-type"] == "application/json"
     assert json.loads(event["response_body"]) == {
         "ok": True,
@@ -336,6 +341,7 @@ def test_consumer_name_and_client_ip_resolvers_are_recorded() -> None:
 
     assert response.status_code == 200
     assert fake.ingest_calls[0]["consumer_name"] == "rapidapi-user"
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
     assert fake.ingest_calls[0]["client_ip"] == "203.0.113.10"
 
 

{reqkey-0.2.0 → reqkey-0.2.1}/tests/test_wsgi.py

@@ -183,6 +183,7 @@ def test_wsgi_both_mode_validates_and_records_correlated_metadata() -> None:
     ]
     event = fake.ingest_calls[0]
     assert event["request_id"] == "request_123"
+    assert event["api_key"] == "prod_consumer"
     assert event["path"] == "/protected?page=2"
     assert event["query_params"] == {"page": "2"}
     assert event["client_ip"] == "127.0.0.1"
@@ -201,6 +202,7 @@ def test_wsgi_missing_key_is_denied_before_application() -> None:
     assert json.loads(body)["error"] == "missing_api_key"
     assert fake.verify_calls == []
     assert fake.ingest_calls[0]["request_id"] is None
+    assert fake.ingest_calls[0]["api_key"] is None
     assert fake.ingest_calls[0]["status_code"] == 401
     assert fake.ingest_calls[0]["path"] == "/protected"
 
@@ -217,6 +219,7 @@ def test_wsgi_rate_limit_preserves_retry_after_and_skips_application() -> None:
     assert json.loads(body)["error"] == "rate_limited"
     assert fake.ingest_calls[0]["request_id"] == "request_limited"
     assert fake.ingest_calls[0]["status_code"] == 429
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
 
 
 def test_wsgi_denied_ingestion_can_be_disabled() -> None:
@@ -259,6 +262,7 @@ def test_wsgi_resolves_consumer_name_and_client_ip() -> None:
 
     assert status == 200
     assert fake.ingest_calls[0]["consumer_name"] == "rapidapi-user"
+    assert fake.ingest_calls[0]["api_key"] == "prod_consumer"
     assert fake.ingest_calls[0]["client_ip"] == "203.0.113.10"
 
 
@@ -322,7 +326,7 @@ def test_wsgi_reports_validation_and_ingestion_errors() -> None:
     assert ingest_events[0].request_id == "request_123"
 
 
-def test_wsgi_query_key_is_validated_but_never_ingested() -> None:
+def test_wsgi_query_key_is_redacted_from_path_but_ingested_as_identity() -> None:
     fake = FakeReqKey(allowed_result())
     middleware = ReqKeyMiddleware(
         app,
@@ -343,7 +347,7 @@ def test_wsgi_query_key_is_validated_but_never_ingested() -> None:
     event = fake.ingest_calls[0]
     assert event["query_params"] == {"page": "2"}
     assert event["path"] == "/protected?page=2"
-    assert "prod_secret" not in str(event)
+    assert event["api_key"] == "prod_secret"
 
 
 def test_wsgi_failure_mode_open_runs_application_and_records_error() -> None: