[AdirAmsalem]

Apps that authenticate with short-lived client tokens can now use one client for everything: apiKeyProvider supplies the credential for every HTTP request (process, queue, files, tokens), not just realtime connects and reconnects. Until now the HTTP APIs ignored it, so a browser app had to mint a token and build a new client before every batch call. The provider is called right before each request, including every submitAndPoll status poll and the result download, and wins over apiKey; without a provider nothing changes, and proxy mode never calls it. Because the API checks the token once the request body has fully arrived, the docs now say to mint upload tokens with an expiresIn that covers the upload.

Usage

const client = createDecartClient({ apiKeyProvider: () => fetchClientTokenFromYourServer() });

// The provider runs before the submit, each status poll and the result download.
const result = await client.queue.submitAndPoll({ model: models.video("lucy-latest"), prompt, data: videoFile });

---

Note

Medium Risk
Auth behavior changes for apps using apiKeyProvider with batch/HTTP APIs (more provider calls, different keys per poll); proxy and static apiKey paths are unchanged.

Overview
apiKeyProvider now supplies credentials for all direct HTTP APIs, not only realtime connect/reconnect. createDecartClient builds a shared getApiKey from createCredentialSource when a provider is set in non-proxy mode; process, queue, files, and tokens call it immediately before each request (including every submitAndPoll status poll and the result download). The provider overrides a static apiKey; behavior is unchanged when no provider is configured. Proxy mode still sends no API key and does not invoke the provider for HTTP.

Docs and JSDoc now describe per-request minting, no SDK caching, and that upload tokens need an expiresIn long enough for the body to finish uploading because auth is checked after the request body arrives. Unit tests cover per-request keys, invalid provider results, and proxy mode skipping the provider.

^{Reviewed by Cursor Bugbot for commit 1e90149. Bugbot is set up for automated code reviews on this repo. Configure here.}