e2b-dev--e2b/.changeset/quick-spoons-remove.md at @e2b/python-sdk@2.29.3

Files

T

Mish Ushakov f3e7f33973 refactor(sdks): tidy SDK auth and deprecate ConnectionConfig access token (#1452 )

## Summary

The access token was only ever used by the CLI, never by any SDK
operation — sandbox, template, and volume calls all authenticate with
the API key. This cleans up the auth plumbing and **deprecates** (rather
than removes) the access token on `ConnectionConfig`, so there's no
breaking change for direct SDK consumers.

## Changes

- **Deprecated** the `accessToken` (JS) / `access_token` (Python) option
on `ConnectionConfig`. It still works exactly as before — when set (or
via `E2B_ACCESS_TOKEN`) the `Authorization: Bearer` header is still sent
— but `apiHeaders` is now the recommended way to pass custom auth.
- **Clear error when the API key is missing**, pointing to the API Keys
tab (`https://e2b.dev/dashboard?tab=keys`). In JS this is gated by a
`requireApiKey` option (default `true`) so callers that authenticate
differently — like the CLI hitting `/teams` with an access token — can
opt out; in Python the API key is always required.
- Removed the unused access-token toggle from the API clients:
`requireAccessToken` (JS) / `require_access_token` (Python). No caller
ever set it to a non-default value, so behavior is unchanged.
- The CLI now passes the access token to the `/teams` endpoint via
`apiHeaders` instead of the deprecated option, and opts out of the
API-key requirement on its own clients.
- Decoupled the sandbox-scoped envd access token from
`ConnectionConfig`: `EnvdApiClient` now owns its own `envdAccessToken`
field and sets the `X-Access-Token` header itself, removing a redundant
manually-set header.

## Recommended usage

```ts
// Deprecated
new ConnectionConfig({ accessToken: 'my-token' })

// Preferred
new ConnectionConfig({ apiHeaders: { Authorization: 'Bearer my-token' } })
```

```python
# Deprecated
ConnectionConfig(access_token="my-token")

# Preferred
ConnectionConfig(api_headers={"Authorization": "Bearer my-token"})
```

## Verification

`pnpm run typecheck`, `pnpm run lint`, Python `make typecheck`, and the
unit tests all pass — including new tests for the API-key requirement
(and its opt-out) in both SDKs. Confirmed the `Authorization: Bearer`
header is still sent for both the deprecated option and
`E2B_ACCESS_TOKEN`.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-18 14:20:21 +02:00

1.3 KiB

Raw Permalink Blame History

@e2b/python-sdk, e2b, @e2b/cli

@e2b/python-sdk	e2b	@e2b/cli
patch	patch	patch

Tidy up SDK authentication and deprecate the access token in ConnectionConfig.

Deprecated the accessToken (JS) / access_token (Python) option on ConnectionConfig. It still works exactly as before — when set (or via E2B_ACCESS_TOKEN), the Authorization: Bearer header is still sent — but you should pass custom auth through apiHeaders instead, e.g. new ConnectionConfig({ apiHeaders: { Authorization: 'Bearer <token>' } }).
The SDK now raises a clear error when no API key is supplied, pointing to the API Keys tab (https://e2b.dev/dashboard?tab=keys). In JS this is controlled by a requireApiKey option (default true) so callers that authenticate differently — like the CLI hitting /teams with an access token — can opt out; in Python the API key is always required.
Removed the unused access-token toggle from the API clients: requireAccessToken (JS) and require_access_token (Python). No caller ever set it to a non-default value, so behavior is unchanged.
The CLI now passes the access token to the /teams endpoint through apiHeaders instead of the deprecated option.
Decoupled the sandbox-scoped envd access token from ConnectionConfig: EnvdApiClient now owns its own accessToken field and sets the X-Access-Token header itself.

1.3 KiB Raw Permalink Blame History

1.3 KiB

Raw Permalink Blame History