Skip to content

feat(MBL-2330): one-key CustomerIO client - #254

Open
sydneycollins-cio wants to merge 2 commits into
mainfrom
mbl-2330
Open

sydneycollins-cio wants to merge 2 commits into
mainfrom
mbl-2330

Conversation

@sydneycollins-cio

@sydneycollins-cio sydneycollins-cio commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

Update to support the new private key

sydneycollins-cio and others added 2 commits September 30, 2026 15:57
new CustomerIO({ apiKey }) sends tracking to the Track API and transactional
sends to the App API, both with the key as Bearer. ak_us_/ak_eu_ keys pick
the region; an explicit region wins; legacy keys keep the US default.

A wk_ key throws KeyCapabilityError on transactional calls before any
request, and a 401/403 from either API is rethrown as KeyCapabilityError.
TrackClient and APIClient are unchanged. README now leads with CustomerIO
instead of the CDP client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sydneycollins-cio

Copy link
Copy Markdown
Contributor Author

Tested locally at this PR's head (d51a225969) against services 199c4a789c, CDP aa721dbec and edge af983b44, all at main. Keys were made through services' UI API and synced to CDP and edge the normal way. A pass-through proxy recorded the auth scheme and status. CDP ran in strict mode, so a bad key gets an error instead of 200.

Key Call Result
ak_ identify Bearer, 200
ak_ track event Bearer, 200
ak_ send email Bearer, 200 on /v1/send/email
wk_ identify Bearer, 200
wk_ send email refused by the SDK (no transactional access), no request sent
legacy App API key send email Bearer, 200
legacy site ID + API key old Track client identify Basic, 200
revoked ak_ identify 401, SDK reports the key can't use Track

No key showed up in the SDK's output or logs. All passed.

@sydneycollins-cio
sydneycollins-cio marked this pull request as ready for review October 13, 2026 16:36

@Shahroz16 Shahroz16 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving from my side. A couple of small follow-ups:

Could we make the 401/403 message a bit more general? A valid key can get those for an IP restriction or a disabled workspace too, so “this key can't…” can send someone looking at key permissions when that may not be the issue. Keeping the original error is helpful; I think this just needs clearer wording.

Also, could we qualify “Legacy App API keys also work here” in the README? They work for transactional calls, but Bearer Track calls on Pipelines workspaces need a source-bound new key.

That's my take. Let's also get Bernard or the NF team to review this.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants