API TOKEN client side verification missing.

[asingh9530]

Hi Team,

I wanted to know why there is no token check at client side, for context I was running this sample here but I was exporting API TOKEN incorrectly and as soon as I ran following replicate.run it throws an error ReplicateError: You did not pass an authentication token which is expected but why there is no warning or type error raised in client.py specifically in following code

    if (
        api_token := api_token or os.environ.get("REPLICATE_API_TOKEN")
    ) and api_token != "":
        headers["Authorization"] = f"Token {api_token}"

it could have been something like this

if (
        api_token := api_token or os.environ.get("REPLICATE_API_TOKEN")
    ) and api_token != "" and len(api_token) == TOKEN_LENGTH:
        headers["Authorization"] = f"Token {api_token}"
else:
        raise ValueError("Invalid token provided check if token present")

Token verification should happen at client's end only authentication should be done at server's end. if this is a design choice would like to know reason if this is something you want to fix happy to raise PR since this is a very small change.

[mattt]

Hi @asingh9530. We delegate the auth check to the server because the client library can be used with a custom base URL. For example, you could proxy Replicate's API, and add an auth header on outgoing requests, in which case the API token isn't required.