Skip to content

fix(docs): include API key header in generated code samples - #6630

Merged
TheodoreSpeaks merged 1 commit into
stagingfrom
fix/doc-no-api-key
Aug 12, 2026
Merged

fix(docs): include API key header in generated code samples#6630
TheodoreSpeaks merged 1 commit into
stagingfrom
fix/doc-no-api-key

Conversation

@TheodoreSpeaks

@TheodoreSpeaks TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Fumadocs builds sample requests from declared parameters only, so an operation's security requirement never reached the generated code — every v2 endpoint documented an unauthenticated call that returns 401
  • Wire generateCodeSamples to wrap each built-in language generator and prepend the operation's auth headers, resolved from operation.security (falling back to document-level security) against components.securitySchemes
  • Tab ids, order, language and labels come from fumadocs' own default registry, so nothing is hardcoded; throws if the specs disagree on default security or a scheme can't be expressed as a header

Type of Change

  • Bug fix

Testing

Tested manually against next dev — cURL, JavaScript, Go, Python, Java and C# all emit X-API-Key: YOUR_API_KEY on SSR and after client-side navigation, verified on GET /api/v2/billing/logs, DELETE /api/v2/workflows/{id} and POST /api/v2/workflows/{id}/execute (body endpoint, auth header ahead of Content-Type). bun run type-check, bun run lint:check and bun run check:audits (25 audits) pass.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@vercel

vercel Bot commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview Aug 12, 2026 5:41pm

Request Review

@cursor

cursor Bot commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Low Risk
Docs-only change to sample generation; no runtime API or auth behavior is modified.

Overview
API reference code samples now include authentication headers (e.g. X-API-Key: YOUR_API_KEY) instead of showing unauthenticated requests that would return 401.

The docs API page wires Fumadocs’ generateCodeSamples to getAuthenticatedCodeSamples, which reads operation.security (or document-level security), maps components.securitySchemes to header values, and wraps each built-in language generator via generateWithAuth so auth headers are merged into the snippet. Tab languages and labels still come from Fumadocs’ default registry.

Build-time guards: all OpenAPI spec files must agree on default security; unsupported or missing schemes throw with clear [docs] errors. Operations with no auth requirement get no custom samples (empty list).

Reviewed by Cursor Bugbot for commit 03b74c2. Bugbot is set up for automated code reviews on this repo. Configure here.

@greptile-apps

greptile-apps Bot commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR adds authentication headers to generated OpenAPI code samples while retaining Fumadocs’ built-in language registry.

  • Resolves operation-level security with document-level fallback.
  • Converts supported API-key and bearer schemes into placeholder request headers.
  • Wraps each built-in generator so authenticated samples include the resolved headers.
  • Leaves anonymous operations on Fumadocs’ existing unauthenticated generators.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed
Filename Overview
apps/docs/app/[lang]/[[...slug]]/page.tsx Connects authenticated code-sample generation to the OpenAPI page configuration.
apps/docs/lib/openapi-code-samples-client.ts Wraps built-in client-side generators and merges resolved authentication headers into request data.
apps/docs/lib/openapi-code-samples.ts Recreates Fumadocs’ default generator metadata with authenticated wrapper functions.
apps/docs/lib/openapi.ts Resolves shared and operation-level security requirements into headers and preserves default samples for anonymous operations.

Reviews (2): Last reviewed commit: "fix(docs): include API key header in gen..." | Re-trigger Greptile

greptile-apps[bot]
greptile-apps Bot reviewed Aug 12, 2026
View reviewed changes
Comment thread apps/docs/lib/openapi.ts
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor review

cursor[bot]
cursor Bot reviewed Aug 12, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 03b74c2. Configure here.

@TheodoreSpeaks
TheodoreSpeaks merged commit afa0293 into staging Aug 12, 2026
30 checks passed
@TheodoreSpeaks
TheodoreSpeaks deleted the fix/doc-no-api-key branch August 12, 2026 17:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@TheodoreSpeaks