Type the client token's signed token as always present

[AdirAmsalem]

Description

tokens.create() now types the signed token as always present instead of str | None. api_key stays as the opaque form for calls other than realtime and file uploads.

Changes

• CreateTokenResponse.token is str. A response without it raises TokenCreateError instead of returning None.
• Docstrings and the create_token example point frontends at token.

Merge after api-platform#822 is deployed; before that, a mint whose signing failed would raise here instead of returning the opaque key.

token = await client.tokens.create()
return {"token": token.token, "expiresAt": token.expires_at}  # what your frontend uses

---

Note

Medium Risk
This is a breaking typing/behavior change for integrators who branched on token is None, and mint calls can fail hard if deployed before the platform always returns a signed token.

Overview
tokens.create() now treats the signed JWT as mandatory, matching the platform contract after api-platform#822.

CreateTokenResponse.token is typed as str (not str | None). If a successful HTTP response omits token, the client raises TokenCreateError instead of returning None. Docstrings clarify that token is what browsers should use for realtime and uploads, while api_key remains the opaque ek_... credential for other calls.

The example and tests expect a JWT in every success payload, and a new test covers the missing-token error path.

^{Reviewed by Cursor Bugbot for commit cecc889. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cecc889. Configure here.}