Remove mutual exclusivity between PAT and API+App key auth

Author: tausman

.generator/src/generator/templates/client.j2

@@ -84,16 +84,12 @@ func UseDelegatedTokenAuth(ctx context.Context, headerParams *map[string]string,
 }
 
 // SetAuthKeys sets the appropriate values in the headers parameter.
-// When a bearer token is present in the context, only the
-// Authorization: Bearer header is sent. No API key or app key
-// headers are included — bearer auth is a standalone auth path.
 func SetAuthKeys(ctx context.Context, headerParams *map[string]string, keys ...[2]string) {
 	if ctx == nil {
 		return
 	}
 	if bearerToken, ok := ctx.Value(ContextBearerToken).(string); ok {
 		(*headerParams)[authorizationHeader] = fmt.Sprintf(bearerTokenFormat, bearerToken)
-		return
 	}
 	for _, key := range keys {
 		if auth, ok := ctx.Value(ContextAPIKeys).(map[string]APIKey); ok {

api/datadog/client.go

@@ -86,16 +86,12 @@ func UseDelegatedTokenAuth(ctx context.Context, headerParams *map[string]string,
 }
 
 // SetAuthKeys sets the appropriate values in the headers parameter.
-// When a bearer token is present in the context, only the
-// Authorization: Bearer header is sent. No API key or app key
-// headers are included — bearer auth is a standalone auth path.
 func SetAuthKeys(ctx context.Context, headerParams *map[string]string, keys ...[2]string) {
 	if ctx == nil {
 		return
 	}
 	if bearerToken, ok := ctx.Value(ContextBearerToken).(string); ok {
 		(*headerParams)[authorizationHeader] = fmt.Sprintf(bearerTokenFormat, bearerToken)
-		return
 	}
 	for _, key := range keys {
 		if auth, ok := ctx.Value(ContextAPIKeys).(map[string]APIKey); ok {

tests/api/client_test.go

@@ -161,7 +161,7 @@ func TestApiAppKeyAuthenticate(t *testing.T) {
 	assert.Equal(t, headers["DD-APPLICATION-KEY"], appKey)
 }
 
-func TestPATAuthentication(t *testing.T) {
+func TestBearerTokenAuthentication(t *testing.T) {
 	pat := "ddapp_test-pat-token"
 	keys := map[string]datadog.APIKey{
 		"apiKeyAuth": {Key: "api-key"},
@@ -181,8 +181,7 @@ func TestPATAuthentication(t *testing.T) {
 		[2]string{"appKeyAuth", "DD-APPLICATION-KEY"},
 	)
 	assert.Equal(t, "Bearer ddapp_test-pat-token", headers["Authorization"])
-	assert.Empty(t, headers["DD-API-KEY"], "PAT auth should not send DD-API-KEY")
-	assert.Empty(t, headers["DD-APPLICATION-KEY"], "PAT auth should not send DD-APPLICATION-KEY")
+	assert.Equal(t, "api-key", headers["DD-API-KEY"], "API key should still be sent alongside bearer token")
 }
 
 func TestNewDefaultContextWithBearerToken(t *testing.T) {
@@ -196,19 +195,18 @@ func TestNewDefaultContextWithBearerToken(t *testing.T) {
 	assert.Equal(t, "ddapp_test-pat-token", bearerToken)
 }
 
-func TestNewDefaultContextBearerTokenOverridesAppKey(t *testing.T) {
+func TestNewDefaultContextAllAuthHeadersSentTogether(t *testing.T) {
 	t.Setenv("DD_API_KEY", "test-api-key")
 	t.Setenv("DD_APP_KEY", "test-app-key")
 	t.Setenv("DD_BEARER_TOKEN", "ddapp_test-pat-token")
 
 	ctx := datadog.NewDefaultContext(context.Background())
-	// App key is still stored, but bearer token takes precedence in SetAuthKeys
 	keys := ctx.Value(datadog.ContextAPIKeys).(map[string]datadog.APIKey)
 	assert.Equal(t, "test-app-key", keys["appKeyAuth"].Key)
 	bearerToken := ctx.Value(datadog.ContextBearerToken).(string)
 	assert.Equal(t, "ddapp_test-pat-token", bearerToken)
 
-	// Verify bearer token is used — no API key or app key headers
+	// All auth headers should be sent together
 	headers := map[string]string{}
 	datadog.SetAuthKeys(
 		ctx,
@@ -217,8 +215,8 @@ func TestNewDefaultContextBearerTokenOverridesAppKey(t *testing.T) {
 		[2]string{"appKeyAuth", "DD-APPLICATION-KEY"},
 	)
 	assert.Equal(t, "Bearer ddapp_test-pat-token", headers["Authorization"])
-	assert.Empty(t, headers["DD-API-KEY"], "Bearer auth should not send DD-API-KEY")
-	assert.Empty(t, headers["DD-APPLICATION-KEY"], "Bearer auth should not send DD-APPLICATION-KEY")
+	assert.Equal(t, "test-api-key", headers["DD-API-KEY"], "API key should be sent alongside bearer token")
+	assert.Equal(t, "test-app-key", headers["DD-APPLICATION-KEY"], "App key should be sent alongside bearer token")
 }
 
 func TestNewDefaultContextAppKeyWithoutBearerToken(t *testing.T) {
@@ -257,6 +255,4 @@ func TestPATBearerHeaderSentViaHTTPClient(t *testing.T) {
 
 	assert.Equal(t, 200, httpResp.StatusCode)
 	assert.Equal(t, "Bearer "+pat, capturedHeaders.Get("Authorization"))
-	assert.Empty(t, capturedHeaders.Get("DD-API-KEY"), "PAT auth should not send DD-API-KEY")
-	assert.Empty(t, capturedHeaders.Get("DD-APPLICATION-KEY"), "PAT auth should not send DD-APPLICATION-KEY")
 }