TS: apikey/accessToken not included in requests

joshbalfour commented 1 year ago

Preflight checklist

[X] I could not find a solution in the existing issues, docs, nor discussions.
[X] I agree to follow this project's Code of Conduct.
[X] I have read and am following this repository's Contribution Guidelines.
[X] This issue affects my Ory Network project.
[X] I have joined the Ory Community Slack.
[X] I am signed up to the Ory Security Patch Newsletter.

Describe the bug

apiKey/accessToken does not get added to the request when using the typescript SDK, resulting in admin calls rejecting as unauthorised.

You can work around it if you set the baseOptions to specify the header yourself.

Reproducing the bug

const hydra = new OAuth2Api(new Configuration({
  basePath: 'https://slug.projects.oryapis.com/',
  apiKey: 'ory_pat_xyz',
}))
hydra.listOAuth2Clients().then(console.log).catch(console.error)

Relevant log output

{
    "error": {
        "code": 401,
        "status": "Unauthorized",
        "request": "e5490b83-f7d5-9399-8136-283766c823b4",
        "message": "Access credentials are invalid"
    }
}

Relevant configuration

No response

Version

"@ory/hydra-client": "^2.0.2"

On which operating system are you observing this issue?

Ory Network

In which environment are you deploying?

Ory Network

Additional Context

No response

joshbalfour commented 1 year ago

Weirdly i found this did work when using ProjectAPI from "@ory/client": "^1.1.21"

jonas-jonas commented 1 year ago

Hi, thanks for the report. When working with the Ory Network, we recommend using the @ory/client package. @ory/hydra-client is meant to be used with standalone Hydra instances.

Though, I also only got that working when using the accessToken parameter, not apiKey.

Also, just noticed that this report is a month old, sorry for the delay.

glawler commented 1 year ago

I see this in @ory/kratos-client as well. We self-host so do not use @ory/client. Periodically the token does not get added to requests. I've not been able to track down what specifically causes this though.

ory / sdk