authStyle: 'x-api-key' is documented as supported but always fails against /v1 with 401 missing_credentials

[BSalaeddin]

Found while building the official Python SDK (DevinoSolutions/getitdone-python). The Python SDK deliberately does not port this option; filing so the TS SDK can be corrected.

What

GetItDoneOptions.authStyle (packages/sdk/src/client.ts:44-48) is documented as:

/**
 * How to present the key: `authorization` (`Bearer …`, default) or the
 * `x-api-key` header — the API accepts both.
 */
authStyle?: 'authorization' | 'x-api-key'

"the API accepts both" is not true for /v1. Setting authStyle: 'x-api-key' makes every call fail with 401 missing_credentials.

apps/web/src/lib/public-api/define-route.ts:128-134 only reads the Authorization header:

if (!authHeader?.startsWith('Bearer ')) -> 401 missing_credentials

x-api-key is accepted only on the legacy /api/* surface (apps/web/src/lib/api-auth.ts:5,79).

Verified against production, 2026-08-05

Request to GET https://app.nowgetitdone.com/v1/organizations	Result
x-api-key: gid_invalid_probe	401 missing_credentials — the key was never even looked at
Authorization: Bearer gid_invalid_probe	401 invalid_api_key — the key WAS evaluated

The differing problem codes are the proof: with x-api-key the request is rejected before credential lookup.

Impact

Any integrator who sets authStyle: 'x-api-key' — a documented, type-supported option — gets a 100% failure rate with an error message telling them their credentials are missing, while their credentials are in fact fine. That is an expensive debugging session.

Suggested fix

Pick one:

1. Remove the option (preferred). It is a 0.1.0 SDK; deleting a broken option now is cheap. Authorization: Bearer is the only scheme /v1 supports.
2. Keep the option but make /v1 genuinely accept x-api-key in define-route.ts, and add a test that pins both schemes.

Either way, packages/sdk/src/core/http.ts:259-263 and the docstring need to agree with reality.

Note

getitdone-py ships Bearer-only, with a regression test asserting x-api-key is never sent (tests/unit/test_client.py::test_every_request_carries_bearer_auth_a_custom_user_agent_and_accept_json).

Reference

PRD blocker B8, C:\Users\alaed\Desktop\devino\sdk\getitdone\PRD.md §2.2 / §9.

[BSalaeddin]

Fixed in DevinoSolutions/GetItDone#224 (this repo is a read-only mirror force-synced from the monorepo's packages/sdk, so the fix has to land there — a direct commit here would be wiped by the next sync).

Went with a hard deprecation rather than deletion, since 0.1.0 is already on npm and removing the option outright is a breaking type change:

• HttpCore is now Bearer-only — authStyle is gone from its config and every request sends Authorization: Bearer ….
• The public authStyle option is @deprecated with the real reason in the JSDoc, and passing 'x-api-key' logs a loud deprecation warning and is ignored — so calls that previously failed 100% of the time now succeed instead of breaking at compile time.
• Removal is scheduled for 0.2.0 (README, JSDoc and changeset all say so).
• Tests now pin the opposite of the old behavior: Bearer always, never an x-api-key header, warn exactly once under the deprecated style.

Also fixed the same false claim in the customer-facing docs, which was arguably worse than the SDK option: /docs/api offered x-api-key as an equal alternative, the .md/llms.txt twin said "is also accepted", and the missing_credentials problem page told people to fix the error by sending x-api-key — i.e. it recommended the exact thing that causes it. That header is now listed as a probable cause.

Not published: the release rides the normal Changesets flow on main. Leaving this open until the fix ships to npm.