fix(csharp): ensure client-level headers are included for all endpoints#11837
Merged
Swimburger merged 12 commits intomainfrom Jan 29, 2026
Merged
fix(csharp): ensure client-level headers are included for all endpoints#11837Swimburger merged 12 commits intomainfrom
Swimburger merged 12 commits intomainfrom
Conversation
Co-Authored-By: Niels Swimberghe <3382717+Swimburger@users.noreply.github.com>
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
Swimburger
approved these changes
Jan 28, 2026
Add AddWithoutAuth method to HeadersBuilder that excludes the Authorization header when adding client-level headers. This prevents lazy OAuth token resolution for endpoints that don't require authentication. For endpoints with auth=false, the generated code now uses AddWithoutAuth instead of Add when adding _client.Options.Headers, which avoids triggering the OAuth token provider for no-auth endpoints. Co-Authored-By: Niels Swimberghe <3382717+Swimburger@users.noreply.github.com>
The OAuthTokenProvider only sends required fields (client_id, client_secret), while the example may include optional fields (scope, audience, grant_type). This caused mock server tests to fail because the mock expected an exact body match that didn't match the actual request. Now OAuth and refresh token endpoint mocks only match on path and method, allowing the tests to pass regardless of which optional fields are included in the request. Co-Authored-By: Niels Swimberghe <3382717+Swimburger@users.noreply.github.com>
- Updated multiple API client implementations to replace the use of AddWithoutAuth with Add for adding headers. - This change ensures that all headers, including authorization headers, are processed consistently across different clients. - Enhanced the HeadersBuilder class to include a new method AddWithoutAuth for scenarios where authorization headers should be excluded. - Adjusted the usage of header building in SeedApiClient, CompletionsClient, DummyClient, AdminClient, and others to reflect this change.
…69561060-fix-csharp-headers
…d of AddWithoutAuth - Updated UserClient in multi-line-docs to use Add for headers. - Updated RetriesClient in no-retries to use Add for headers. - Updated SeedApiClient in nullable-allof-extends to use Add for headers. - Updated NullableOptionalClient in explicit-nullable-optional and no-custom-config to use Add for headers. - Updated ApiClient in oauth-client-credentials-custom, default, environment-variables, nested-root, with-variables, and include-exception-handler to use Add for headers. - Updated ServiceClient in package-yml, plain-text, and public-object to use Add for headers. - Updated OrganizationsClient in path-parameters to use Add for headers. - Updated HomepageClient, PlaylistClient, ProblemClient, SubmissionClient, and SyspropClient in trace to use Add for headers. - Updated V2Client and ProblemClient in V2 to use Add for headers. - Updated SeedUndiscriminatedUnionWithResponsePropertyClient and UnionClient in undiscriminated-unions to use Add for headers. - Updated BigunionClient and TypesClient in unions-with-local-date to use Add for headers. - Updated BigunionClient and UnionClient in unions to use Add for headers. - Updated BigunionClient and UnionClient in no-discriminated-unions to use Add for headers. - Updated ServiceClient in variables to use Add for headers. - Updated UserClient in version-no-default and version to use Add for headers.
Fixes a bug where authentication headers were being sent to OAuth token endpoints, causing authentication failures. The fix separates platform headers (X-Fern-Language, SDK name/version, User-Agent) from authentication headers (Authorization, API keys) in the client initialization flow. Changes: - Platform headers now use clientOptions without auth for OAuth token requests - Auth headers are added to a cloned clientOptionsWithAuth for authenticated requests - The main RawClient uses clientOptionsWithAuth to ensure auth is applied - Updated snippet generation to use correct header handling in examples - Simplified RequestBodyProperty type to reuse IR types This ensures OAuth token requests don't inadvertently include auth headers that should only be present on authenticated API calls.
…69561060-fix-csharp-headers
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Refs HumeAI/hume-dotnet-sdk#50
Fixes a bug where endpoints without endpoint-specific headers were not including client-level headers (API key, SDK version, additional headers) in their HTTP requests. This caused authentication failures for APIs that rely on headers set at the client level.
Link to Devin run: https://app.devin.ai/sessions/b8844221aa0442eb94713d370c93c6f7
Requested by: Niels Swimberghe (@Swimburger)
Changes Made
WrappedEndpointRequest.tsto always generate header code, even when there are no endpoint-specific headers (removed early return whenheaders.length === 0)ReferencedEndpointRequest.tsandBytesOnlyEndpointRequest.tsto generate header code that includes client-level headers instead of returningundefinedgetDefaultHeaderParameterCodeBlock()helper method inHttpEndpointGenerator.tsfor endpoints without a request parameterHttpEndpointGenerator.tsto use the default header code block as a fallbackAddWithoutAuth()method toHeadersBuilder.Template.csthat excludes the Authorization header when adding client-level headersauth=false, generated code now usesAddWithoutAuth()to avoid triggering lazy OAuth token resolutionversions.ymlwith changelog entryUpdates since last revision
Fixed CI failure on
oauth-client-credentials-with-variablesfixture where no-auth endpoints were triggering OAuth token resolution:AddWithoutAuth()method to HeadersBuilder that skips the "Authorization" headerendpoint.authand useAddWithoutAuth()for no-auth endpointsFixed mock server test failures for OAuth endpoints:
OAuthTokenProvideronly sends required fields (client_id, client_secret), while examples may include optional fields (scope, audience, grant_type)MockEndpointGeneratorto acceptskipBodyMatchoptionTesting
csharp-sdk:exhaustivefixture (4/4 test cases)csharp-sdk:oauth-client-credentials-with-variablesfixturepnpm run check)Human Review Checklist
AddWithoutAuth()is sufficient for all auth schemes (OAuth, API key, etc.)endpoint.authboolean correctly identifies endpoints that don't require authentication