Handle api_key alias in flags token assertions

[marandaneto]

Problem

Some SDKs send api_key instead of token in /flags request bodies. The harness default assertion expects token, causing otherwise valid requests to fail the feature flag contract.

Changes

• Allow top-level api_key to satisfy /flags request field assertions for token.
• Add test coverage for both token and api_key request body fields.
• Add negative test coverage for missing auth fields and mismatched api_key alias values.
• Update the test helper to allow custom decompressed request bodies.
• Bump the package patch version to 0.5.2 in pyproject.toml and uv.lock.
• Add a 0.5.2 changelog entry documenting the fix.

Checklist

• Added/updated tests
• Updated changelog
• Bumped patch version
• Added changeset

Test plan

• uv run --with pytest --with pytest-asyncio pytest tests/test_feature_flag_support.py

[marandaneto]

some sdks fail because they send api_token isntead of token which is an alias for the /flags request
eg PostHog/posthog-python#576 (comment)

[github-actions]

minimal-adapter Compliance Report

Date: 2026-05-22 08:23:55 UTC
Duration: 363ms

✅ All Tests Passed!

16/16 tests passed

---

Feature_Flags Tests

✅ 16/16 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	10ms
Request Payload.Flags Request Uses V2 Query Param	✅	7ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	6ms
Request Payload.Flags Request Omits Authorization Header	✅	7ms
Request Payload.Token In Flags Body Matches Init	✅	7ms
Request Payload.Groups Round Trip	✅	7ms
Request Payload.Groups Default To Empty Object	✅	6ms
Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It	✅	7ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	6ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	6ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	7ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	8ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	10ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	7ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	10ms

[github-actions]

parallel-adapter Compliance Report

Date: 2026-05-22 08:24:18 UTC
Duration: 237ms

✅ All Tests Passed!

16/16 tests passed

---

Feature_Flags Tests

✅ 16/16 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	21ms
Request Payload.Flags Request Uses V2 Query Param	✅	19ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	18ms
Request Payload.Flags Request Omits Authorization Header	✅	19ms
Request Payload.Token In Flags Body Matches Init	✅	11ms
Request Payload.Groups Round Trip	✅	18ms
Request Payload.Groups Default To Empty Object	✅	17ms
Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It	✅	18ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	16ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	15ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	14ms
Request Lifecycle.No Flags Request On Init Alone	✅	8ms
Request Lifecycle.No Flags Request On Normal Capture	✅	17ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	22ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	13ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	18ms

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
tests/test_feature_flag_support.py:183-200
**Missing negative test cases for alias path**

The parametrized test covers both happy paths (body contains `token` and body contains `api_key`) but omits: (1) the case where neither field is present (should raise `AssertionError`), and (2) the case where `api_key` is present but its value doesn't match `expected` (also should raise). Without these, a regression that accidentally swallows the failure path would not be caught by the test suite.

_{Reviews (1): Last reviewed commit: "Handle api_key alias in flags token asse..." | Re-trigger Greptile}