Add API-key-compatible credential providers (#231)

* feat(auth): add credential provider abstraction

* docs(sdk): clarify credential provider is for QVeris API authentication

Distinguish the CredentialProvider abstraction from the data/tool
providers in the capability catalog: it supplies the bearer value for
the QVeris API itself; upstream provider credentials are managed by the
platform and never pass through the SDK.

* docs: regenerate SDK API references for credential provider exports

Author: linfangw

docs/en-US/js-sdk-api.md

@@ -10,6 +10,52 @@ workflows.
 
 ## Classes
 
+### ApiKeyCredentialProvider
+
+A credential provider backed by a static QVeris API key.
+
+#### Implements
+
+- [`CredentialProvider`](#credentialprovider)
+
+#### Constructors
+
+##### Constructor
+
+> **new ApiKeyCredentialProvider**(`apiKey`): [`ApiKeyCredentialProvider`](#apikeycredentialprovider)
+
+###### Parameters
+
+###### apiKey
+
+`string`
+
+###### Returns
+
+[`ApiKeyCredentialProvider`](#apikeycredentialprovider)
+
+#### Methods
+
+##### getCredential()
+
+> **getCredential**(`_context`): `Promise`\<`string`\>
+
+###### Parameters
+
+###### \_context
+
+[`CredentialContext`](#credentialcontext)
+
+###### Returns
+
+`Promise`\<`string`\>
+
+###### Implementation of
+
+[`CredentialProvider`](#credentialprovider).[`getCredential`](#getcredential-1)
+
+***
+
 ### Qveris
 
 QVeris API client.
@@ -40,7 +86,7 @@ const outcome = await qveris.call(tool.tool_id, {
 
 ###### config
 
-[`QverisClientConfig`](#qverisclientconfig)
+[`QverisClientOptions`](#qverisclientoptions)
 
 ###### Returns
 
@@ -179,7 +225,7 @@ An explicit baseUrl override takes priority over QVERIS_BASE_URL.
 
 ###### overrides?
 
-`Omit`\<[`QverisClientConfig`](#qverisclientconfig), `"apiKey"`\>
+`Omit`\<[`QverisClientOptions`](#qverisclientoptions), `"apiKey"` \| `"credentialProvider"`\>
 
 ###### Returns
 
@@ -709,6 +755,48 @@ Per-request timeout override in milliseconds (default 120s)
 
 ***
 
+### CredentialContext
+
+Context supplied whenever the client requests a credential.
+
+#### Properties
+
+##### resource
+
+> **resource**: `string`
+
+API resource the credential will be sent to.
+
+##### scopes
+
+> **scopes**: readonly `string`[]
+
+Requested authorization scopes. Empty until a public scope contract is available.
+
+***
+
+### CredentialProvider
+
+Supplies a bearer credential for an API request.
+
+#### Methods
+
+##### getCredential()
+
+> **getCredential**(`context`): `string` \| `Promise`\<`string`\>
+
+###### Parameters
+
+###### context
+
+[`CredentialContext`](#credentialcontext)
+
+###### Returns
+
+`string` \| `Promise`\<`string`\>
+
+***
+
 ### CreditsLedgerItem
 
 #### Properties
@@ -1773,6 +1861,14 @@ Error response from the Qveris API.
 
 Union type for execution results (either full data or truncated).
 
+***
+
+### QverisClientOptions
+
+> **QverisClientOptions** = `Omit`\<[`QverisClientConfig`](#qverisclientconfig), `"apiKey"`\> & \{ `apiKey`: `string`; `credentialProvider?`: `never`; \} \| \{ `apiKey?`: `never`; `credentialProvider`: [`CredentialProvider`](#credentialprovider); \}
+
+Configuration accepted by the QVeris REST client.
+
 ## Functions
 
 ### getQverisTools()

docs/en-US/python-sdk-api.md

@@ -10,7 +10,7 @@ This reference is generated from the public Python objects and docstrings. See t
 
 <a id="qveris.QverisClient"></a>
 
-### *class* qveris.QverisClient(config: [QverisConfig](#qveris.QverisConfig) | None = None, debug_callback: Callable[[str], None] | None = None)
+### *class* qveris.QverisClient(config: [QverisConfig](#qveris.QverisConfig) | None = None, debug_callback: Callable[[str], None] | None = None, \*, credential_provider: CredentialProvider | None = None)
 
 Async client for Qveris API.
 

docs/zh-CN/js-sdk-api.md

@@ -8,6 +8,52 @@
 
 ## 类
 
+### ApiKeyCredentialProvider
+
+A credential provider backed by a static QVeris API key.
+
+#### 实现
+
+- [`CredentialProvider`](#credentialprovider)
+
+#### 构造函数
+
+##### 构造函数
+
+> **new ApiKeyCredentialProvider**(`apiKey`): [`ApiKeyCredentialProvider`](#apikeycredentialprovider)
+
+###### 参数
+
+###### apiKey
+
+`string`
+
+###### 返回
+
+[`ApiKeyCredentialProvider`](#apikeycredentialprovider)
+
+#### 方法
+
+##### getCredential()
+
+> **getCredential**(`_context`): `Promise`\<`string`\>
+
+###### 参数
+
+###### \_context
+
+[`CredentialContext`](#credentialcontext)
+
+###### 返回
+
+`Promise`\<`string`\>
+
+###### 实现了
+
+[`CredentialProvider`](#credentialprovider).[`getCredential`](#getcredential-1)
+
+***
+
 ### Qveris
 
 QVeris API client.
@@ -38,7 +84,7 @@ const outcome = await qveris.call(tool.tool_id, {
 
 ###### config
 
-[`QverisClientConfig`](#qverisclientconfig)
+[`QverisClientOptions`](#qverisclientoptions)
 
 ###### 返回
 
@@ -177,7 +223,7 @@ An explicit baseUrl override takes priority over QVERIS_BASE_URL.
 
 ###### overrides?
 
-`Omit`\<[`QverisClientConfig`](#qverisclientconfig), `"apiKey"`\>
+`Omit`\<[`QverisClientOptions`](#qverisclientoptions), `"apiKey"` \| `"credentialProvider"`\>
 
 ###### 返回
 
@@ -707,6 +753,48 @@ Per-request timeout override in milliseconds (default 120s)
 
 ***
 
+### CredentialContext
+
+Context supplied whenever the client requests a credential.
+
+#### 属性
+
+##### resource
+
+> **resource**: `string`
+
+API resource the credential will be sent to.
+
+##### scopes
+
+> **scopes**: readonly `string`[]
+
+Requested authorization scopes. Empty until a public scope contract is available.
+
+***
+
+### CredentialProvider
+
+Supplies a bearer credential for an API request.
+
+#### 方法
+
+##### getCredential()
+
+> **getCredential**(`context`): `string` \| `Promise`\<`string`\>
+
+###### 参数
+
+###### context
+
+[`CredentialContext`](#credentialcontext)
+
+###### 返回
+
+`string` \| `Promise`\<`string`\>
+
+***
+
 ### CreditsLedgerItem
 
 #### 属性
@@ -1771,6 +1859,14 @@ Error response from the Qveris API.
 
 Union type for execution results (either full data or truncated).
 
+***
+
+### QverisClientOptions
+
+> **QverisClientOptions** = `Omit`\<[`QverisClientConfig`](#qverisclientconfig), `"apiKey"`\> & \{ `apiKey`: `string`; `credentialProvider?`: `never`; \} \| \{ `apiKey?`: `never`; `credentialProvider`: [`CredentialProvider`](#credentialprovider); \}
+
+Configuration accepted by the QVeris REST client.
+
 ## 函数
 
 ### getQverisTools()

docs/zh-CN/python-sdk-api.md

@@ -10,7 +10,7 @@
 
 <a id="qveris.QverisClient"></a>
 
-### *class* qveris.QverisClient(config: [QverisConfig](#qveris.QverisConfig) | None = None, debug_callback: Callable[[str], None] | None = None)
+### *class* qveris.QverisClient(config: [QverisConfig](#qveris.QverisConfig) | None = None, debug_callback: Callable[[str], None] | None = None, \*, credential_provider: CredentialProvider | None = None)
 
 Async client for Qveris API.
 

packages/cli/CHANGELOG.md

@@ -12,6 +12,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 - Account and pricing recovery hints now follow the resolved API endpoint for the public sites and custom deployments instead of linking to an unrelated site. ([#221])
 
+### Changed
+
+- Routed authenticated requests through an internal credential-provider boundary while preserving all existing API-key resolution and endpoint-selection behavior. ([#226])
+
 ## [0.8.0] - 2026-07-14
 
 ### Changed
@@ -87,6 +91,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 [0.2.0]: https://github.com/QVerisAI/qveris-agent-toolkit/compare/cli-v0.1.0...cli-v0.2.0
 [0.1.0]: https://github.com/QVerisAI/qveris-agent-toolkit/releases/tag/cli-v0.1.0
 [#221]: https://github.com/QVerisAI/qveris-agent-toolkit/issues/221
+[#226]: https://github.com/QVerisAI/qveris-agent-toolkit/issues/226
 [#204]: https://github.com/QVerisAI/qveris-agent-toolkit/issues/204
 [#161]: https://github.com/QVerisAI/qveris-agent-toolkit/issues/161
 [#144]: https://github.com/QVerisAI/qveris-agent-toolkit/pull/144