Skip to content

fix: report a rejected auth key accurately on login - #302

Merged
MuhammadRafay1 merged 2 commits into
devfrom
error-message-enhancement
Jul 30, 2026
Merged

fix: report a rejected auth key accurately on login#302
MuhammadRafay1 merged 2 commits into
devfrom
error-message-enhancement

Conversation

@MuhammadRafay1

Copy link
Copy Markdown

This PR fixes the gaps identified by QA here: https://github.com/apimatic/apimatic-io/issues/2180#issuecomment-5127202974

The error messaging is now consistent accross whole CLI

Some more Gaps I identified are also fixed
Details below:

Gaps closed

  • auth login --auth-key reported "Unauthorized access." — now names the rejected key and tells the user how to recover.
  • An unreachable server reported "Invalid API key provided." — the invalid-key and network conditions were inverted; each now reports itself.
  • The logged-out auth status message didn't match the guidance every 401 gives — now identical.
  • The shared 401 fallback wording is aligned across all auth failures.
  • Invalid-key detection now compares by error code rather than object identity, so it keeps working for factory-built errors instead of silently falling through.

`auth login --auth-key <invalid>` reported "Unauthorized access." while an
unreachable server reported "Invalid API key provided." The two conditions were
inverted, and neither message told the user what to do next.

- Key the login prompt off `ServiceErrorCode.UnAuthorized` rather than comparing
  the `NetworkError` singleton by reference, so a rejected key is named as such
  and connection failures report themselves. Comparing by code also survives
  factory-built errors, which an identity check silently stops matching.
- Build that message from `ServiceError.unauthorizedWithHint` so the login /
  `--auth-key` guidance is worded identically to every other auth failure.
- Reuse the same hint for the logged-out `auth status` message.
- Reword the shared 401 fallback to "Authorization has been denied for this
  request."

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The hint told users to pass --auth-key to whichever command hit the 401, but
most of them don't declare that flag: `auth status` and `portal toc new` reject
it outright. Name `apimatic auth login --auth-key` instead, so the remedy is
valid wherever the message surfaces, and spell out that a bare `auth login`
authenticates via the browser.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

@MuhammadRafay1
MuhammadRafay1 merged commit d789545 into dev Jul 30, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants