docs: document TypeScript passthrough fetch auth origin scoping#6401
docs: document TypeScript passthrough fetch auth origin scoping#6401devin-ai-integration[bot] wants to merge 1 commit into
Conversation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
There was a problem hiding this comment.
Claude Code Review
Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.
Tip: disable this comment in your organization's Code Review settings.
|
🌿 Preview your docs: https://fern-preview-devin-1784999160-ts-passthrough-auth-origin.docs.buildwithfern.com/learn Here are the markdown pages you've updated: |
Summary
Generated TypeScript SDKs now send their auth credentials on passthrough
client.fetch()calls only when the request targets the SDK's own base URL origin. This matters for customers because passing an absolute third-party URL into the escape hatch previously forwarded the end user's API token to that host; SDK consumers no longer have to sanitize URLs themselves. The behavior shipped in fern-api/fern#17208, and the escape hatch had no prose coverage in the public docs (only SDK changelog entries), so this adds a short section documenting both the method and the origin rule.Pages changed
fern/products/sdks/deep-dives/generated-sdk.mdx(SDK user features) — new## Unmodeled endpointssection: whatclient.fetch()is, that it reuses the client's base URL/headers/timeouts/retries/logging, and the auth rule (relative and same-origin absolute URLs get credentials; cross-origin absolute URLs, including a different port, don't and must supply their own credential headers; no base URL configured means no auth headers; non-auth headers always sent).Link to Devin session: https://app.devin.ai/sessions/872b1bd7bcb441db8b40472c2f03bbca