Correct authorization to use Api-Key

- Updated client and tests to use `Api-Key` as the header name for API
  key injection.
- Refactored default headers construction to reflect this change.
- Modified related test assertions to validate the new header semantics.

Assisted-by: Codex

Author: datalogics-kam

src/pdfrest/client.py

@@ -25,6 +25,7 @@
 
 DEFAULT_BASE_URL = "https://api.pdfrest.com"
 API_KEY_ENV_VAR = "PDFREST_API_KEY"
+API_KEY_HEADER_NAME = "Api-Key"
 DEFAULT_TIMEOUT_SECONDS = 10.0
 FILE_UPLOAD_FIELD_NAME = "file"
 DEFAULT_FILE_INFO_CONCURRENCY = 8
@@ -201,7 +202,7 @@ def __init__(
 
         default_headers: dict[str, str] = {"Accept": "application/json"}
         if resolved_api_key is not None:
-            default_headers["Authorization"] = f"Bearer {resolved_api_key}"
+            default_headers[API_KEY_HEADER_NAME] = resolved_api_key
         if headers:
             for key, value in headers.items():
                 default_headers[str(key)] = str(value)

tests/conftest.py

@@ -22,7 +22,7 @@ def pdfrest_api_key() -> str:
 
 @pytest.fixture(scope="session")
 def pdfrest_live_base_url(pdfrest_api_key: str) -> str:
-    headers = {"Authorization": f"Bearer {pdfrest_api_key}"}
+    headers = {"Api-Key": pdfrest_api_key}
     timeout = httpx.Timeout(2.0)
     for base_url in LIVE_BASE_URL_CANDIDATES:
         try:

tests/test_client.py

@@ -34,7 +34,7 @@ def test_client_uses_provided_api_key(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.delenv("PDFREST_API_KEY", raising=False)
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert request.headers["Authorization"] == f"Bearer {VALID_API_KEY}"
+        assert request.headers["Api-Key"] == VALID_API_KEY
         assert request.url.path == "/up"
         return httpx.Response(200, json=_build_up_response())
 
@@ -53,7 +53,7 @@ def test_client_reads_api_key_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("PDFREST_API_KEY", VALID_API_KEY)
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert request.headers["Authorization"] == f"Bearer {VALID_API_KEY}"
+        assert request.headers["Api-Key"] == VALID_API_KEY
         assert request.url.host == "example.com"
         return httpx.Response(200, json=_build_up_response())
 
@@ -95,7 +95,7 @@ def test_client_allows_missing_api_key_for_custom_host(
     monkeypatch.delenv("PDFREST_API_KEY", raising=False)
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert "Authorization" not in request.headers
+        assert "Api-Key" not in request.headers
         assert request.url.host == "internal.example"
         return httpx.Response(200, json=_build_up_response())
 
@@ -113,7 +113,7 @@ def test_up_with_custom_headers(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.delenv("PDFREST_API_KEY", raising=False)
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert request.headers["Authorization"] == f"Bearer {ANOTHER_VALID_API_KEY}"
+        assert request.headers["Api-Key"] == ANOTHER_VALID_API_KEY
         assert request.headers["X-Test-Header"] == "value"
         return httpx.Response(200, json=_build_up_response())
 
@@ -252,7 +252,7 @@ async def test_async_client_up(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("PDFREST_API_KEY", ASYNC_API_KEY)
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert request.headers["Authorization"] == f"Bearer {ASYNC_API_KEY}"
+        assert request.headers["Api-Key"] == ASYNC_API_KEY
         return httpx.Response(200, json=_build_up_response())
 
     transport = httpx.MockTransport(handler)