TS: apikey/accessToken not included in requests

joshbalfour commented 1 year ago

Preflight checklist

[X] I could not find a solution in the existing issues, docs, nor discussions.
[X] I agree to follow this project's Code of Conduct.
[X] I have read and am following this repository's Contribution Guidelines.
[X] This issue affects my Ory Network project.
[X] I have joined the Ory Community Slack.
[X] I am signed up to the Ory Security Patch Newsletter.

Describe the bug

apiKey/accessToken does not get added to the request when using the typescript SDK, resulting in admin calls rejecting as unauthorised.

You can work around it if you set the baseOptions to specify the header yourself.

Reproducing the bug

const hydra = new OAuth2Api(new Configuration({
  basePath: 'https://slug.projects.oryapis.com/',
  apiKey: 'ory_pat_xyz',
}))
hydra.listOAuth2Clients().then(console.log).catch(console.error)

Relevant log output

{
    "error": {
        "code": 401,
        "status": "Unauthorized",
        "request": "e5490b83-f7d5-9399-8136-283766c823b4",
        "message": "Access credentials are invalid"
    }
}

Relevant configuration

No response

Version

"@ory/hydra-client": "^2.0.2"

On which operating system are you observing this issue?

Ory Network

In which environment are you deploying?

Ory Network

Additional Context

No response

joshbalfour commented 1 year ago

Weirdly i found this did work when using ProjectAPI from "@ory/client": "^1.1.21"

jonas-jonas commented 1 year ago

Hi, thanks for the report. When working with the Ory Network, we recommend using the @ory/client package. @ory/hydra-client is meant to be used with standalone Hydra instances.

Though, I also only got that working when using the accessToken parameter, not apiKey.

Also, just noticed that this report is a month old, sorry for the delay.

glawler commented 1 year ago

I see this in @ory/kratos-client as well. We self-host so do not use @ory/client. Periodically the token does not get added to requests. I've not been able to track down what specifically causes this though.

GauthierPLM commented 1 month ago

I encountered the same issue while switching from @ory/kratos-client to @ory/client: the apiKey parameter is ignored and we have to use the accessToken with a project API key instead.

Why is there two parameters, and why apiKey does not accept the actual API given by Ory?

There are no example in your documentation showing how to use the SDKs, so it's virtually impossible to know without searching in this repo' issues...

aeneasr commented 1 month ago

You need to use the accessTokenKey :)

ory / docs