Add support of Bearer Auth for TrackClient.

[greg-md]

Hi there,

We got a message from CustomerIO to use Bearer Auth instead of Basic Auth when using API.

Hi there,

We've noticed that you've used basic authentication to access the App API in the last 30 days. You will need to change the authentication method within the next 2 weeks, or calls to send triggered broadcasts or transactional messages will fail.

Beginning April 14th at 00:00 UTC we will no longer allow access to our App API through basic authentication. Instead, bearer authentication is required to utilize the API. You can find more details on this authentication scheme in our API documentation.

If you have any questions, simply reply to this email and we'll be happy to help!

Thanks!

CIO Engineering Team

Can you please make TrackClient to support Bearer Auth as well? Currently it supports only Basic Auth.

[xelzi]

Figured this out the hard way today 👎 -- seems that events being sent through the track API are still 👍

But broadcasts will be affected unless this client supports Bearer Auth with App API Keys: https://customer.io/docs/managing-credentials/

[ramirobg94]

+1

[fernandolguevara]

I found this workaround

const CIO = require("customerio-node");
export const cio = new CIO(
  'fake-value',
  'fake-value',
);

cio.request.apikey = cio.request.siteid = cio.request.siteId = null;
cio.request.appKey = "APP Api key"; // GET YOUR APP API KEY FROM HERE => https://fly.customer.io/settings/api_credentials?keyType=app
cio.request.auth = `Bearer ${cio.request.appKey}`;

[ramirobg94]

Thanks @fernandolguevara

I wrote then and the answer was:

We made a change recently to sunset track API keys for app and beta API endpoints. This change now requires that customers access the Beta and App APIs with an App API key.

No matter if you pay tons of $$$ for the service and this broadcast is key for your system... ahhahah

[fernandolguevara]

@ramirobg94

I think that customerio should acknowledge their mistake and reward their customers, also me for reading their source code in search of a solution that they should provide lol

[bradym]

We didn't even get notified, our code just stopped working. 😬

[travisehrenstrom]

Hey Folks, This is Travis with the Customer.io Technical Support Team.

I was pointed to this thread via a support case that our team received. I wanted to clear up a bit of confusion on this thread as well as apologize for missing this alert from ~2 weeks ago.

The Track API service authentication protocol is remaining unchanged as a result of the recent update. The Track service will still be accessed using a Basic auth structure, and that's documented here - https://customer.io/docs/api/#tag/trackAuth

We did make changes to our App API and Beta API to strictly enforce Bearer authentication. https://customer.io/docs/api/#App-API-Key

Upon releasing this feature, we discovered something we'd missed that impacted this Node packaged. Though all other client libraries are strictly using the tracking service, our node package was updated to contain references to API Triggered Broadcasts and Transactional messages.

This means that while track calls are operating as intended, requests to the API Triggered Broadcast and Transactional messaging features will fail.

Our team is actively working on a fix, and we will post an update to new import files here when that's ready to go out.

It's clear that you all were aware of this issue going a few weeks back, and we dropped the ball on catching this feedback. We hope to institute a better monitoring system for inbound feedback over Github moving forward. If you find that you're not getting a sufficient reply here, don't hesitate to contact the Technical Support team directly at win@customer.io, and we will take action.

[ElianCordoba]

Leaked footage of CustomerIO headquarters right now

[kevinkucharczyk]

Sorry for the delay, everyone! As per #46, we've moved triggerBroadcast, so it will now authenticate using the Bearer schema. This has been released as a breaking change under version 2.0.0.