From 7c69408db8578f6f509149c752a8c795c24271cf Mon Sep 17 00:00:00 2001
From: aviau <alexandre@alexandreviau.net>
Date: Fri, 27 Feb 2026 20:05:46 -0500
Subject: [PATCH] allow disabling auth

---
 src/flareio/api_client.py          |  4 ++++
 tests/test_api_client_endpoints.py | 19 +++++++++++++++++++
 tests/utils.py                     |  2 ++
 3 files changed, 25 insertions(+)

diff --git a/src/flareio/api_client.py b/src/flareio/api_client.py
index 080e75a..20858eb 100644
--- a/src/flareio/api_client.py
+++ b/src/flareio/api_client.py
@@ -34,6 +34,7 @@ def __init__(
         tenant_id: t.Optional[int] = None,
         session: t.Optional[requests.Session] = None,
         api_domain: t.Optional[str] = None,
+        _disable_auth: bool = False,
         _enable_beta_features: bool = False,
     ) -> None:
         if not api_key:
@@ -53,6 +54,7 @@ def __init__(
 
         self._api_token: t.Optional[str] = None
         self._api_token_exp: t.Optional[datetime] = None
+        self._disable_auth: bool = _disable_auth
         self._session = session or self._create_session()
 
     @classmethod
@@ -134,6 +136,8 @@ def generate_token(self) -> str:
         return token
 
     def _auth_headers(self) -> dict:
+        if self._disable_auth:
+            return dict()
         api_token: t.Optional[str] = self._api_token
         if not api_token or (
             self._api_token_exp and self._api_token_exp < datetime.now()
diff --git a/tests/test_api_client_endpoints.py b/tests/test_api_client_endpoints.py
index e23c616..45866f2 100644
--- a/tests/test_api_client_endpoints.py
+++ b/tests/test_api_client_endpoints.py
@@ -121,3 +121,22 @@ def test_bad_domain() -> None:
         match="Client was used to access netloc='bad.com' at url='https://bad.com/hello-post'. Only the domain api.flare.io is supported.",
     ):
         client.post("https://bad.com/hello-post")
+
+
+def test_disable_auth_does_not_call_generate() -> None:
+    client = get_test_client(
+        authenticated=False,
+        _disable_auth=True,
+    )
+    with requests_mock.Mocker() as mocker:
+        mocker.register_uri(
+            "POST",
+            "https://api.flare.io/hello-post",
+            status_code=200,
+        )
+        client.post("https://api.flare.io/hello-post", json={"foo": "bar"})
+        assert mocker.last_request.url == "https://api.flare.io/hello-post"
+        assert mocker.last_request.json() == {"foo": "bar"}
+
+        # Authorization header should not be present when auth is disabled
+        assert not mocker.last_request.headers.get("Authorization")
diff --git a/tests/utils.py b/tests/utils.py
index 910ee14..17237bb 100644
--- a/tests/utils.py
+++ b/tests/utils.py
@@ -11,12 +11,14 @@ def get_test_client(
     authenticated: bool = True,
     api_domain: t.Optional[str] = None,
     _enable_beta_features: bool = False,
+    _disable_auth: bool = False,
 ) -> FlareApiClient:
     client = FlareApiClient(
         api_key="test-api-key",
         tenant_id=tenant_id,
         api_domain=api_domain,
         _enable_beta_features=_enable_beta_features,
+        _disable_auth=_disable_auth,
     )
 
     if authenticated: