Fix critical auth: send access-token header instead of Authorization: Bearer (#4)

* Fix: send access-token header instead of Authorization: Bearer

Critical: every authenticated request was being rejected by the
AWS API Gateway in front of api.cryptohopper.com/v1/*. Switching
to access-token: <token> as documented in the official Cryptohopper
API docs and used by the legacy iOS/Android SDKs.

Bump to 0.4.0a2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Drop 'public — no auth required' README claims (same bug surface)

The Exchange and Marketplace sections claimed those endpoints
accepted anonymous calls. The auth-header fix in this PR establishes
that EVERY endpoint on api.cryptohopper.com/v1/* requires a real
token (the AWS API Gateway has no anonymous routes), so the README
labels were misleading. Replaces them with comments that match
reality.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: pimfeltkamp

CHANGELOG.md

@@ -3,7 +3,16 @@
 All notable changes to the `cryptohopper` Python package are documented in this file.
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## 0.4.0a1 — Unreleased
+## 0.4.0a2 — Unreleased
+
+### Fixed
+- **Critical: every authenticated request was rejected by the API gateway.** The transport sent `Authorization: Bearer <token>`, which the AWS API Gateway in front of `api.cryptohopper.com/v1/*` rejects (it routes `Authorization` to a SigV4 parser and returns `405 Missing Authentication Token`). Cryptohopper's Public API v1 uses `access-token: <token>` instead — confirmed by the official [API documentation](https://www.cryptohopper.com/api-documentation/how-the-api-works) and the legacy `cryptohopper-ios-sdk` / `cryptohopper-android-sdk`. Switching the SDK to send `access-token`. The `Authorization` header is no longer set.
+- The `app_key` → `x-api-app-key` header is unchanged; that one was always correct.
+
+### Compatibility
+No public-API change. The fix is purely in the request-builder and is invisible to callers — `client.user.get()`, `client.hoppers.list()`, etc. all keep their existing signatures and behaviour. Only the wire-level header sent on each request changes.
+
+## 0.4.0a1 — 2026-04-25
 
 Adds four more API domains: `social`, `tournaments`, `webhooks`, `app`. Final A-wave — all 14 remaining public domains now covered.
 

README.md

@@ -71,7 +71,7 @@ ch.hoppers.config_get(42)
 ch.hoppers.config_update(42, {"strategy_id": 99})
 ch.hoppers.panic(42)
 
-# Exchange (public — no auth required)
+# Exchange — market data (still requires a real token; the gateway has no anonymous routes)
 ch.exchange.ticker(exchange="binance", market="BTC/USDT")
 ch.exchange.candles(exchange="binance", market="BTC/USDT", timeframe="1h")
 ch.exchange.orderbook(exchange="binance", market="BTC/USDT")
@@ -92,7 +92,7 @@ ch.backtest.list()
 ch.backtest.cancel(1)
 ch.backtest.limits()
 
-# Marketplace (public — no auth required)
+# Marketplace — same auth requirement as everything else
 ch.market.signals(type="buy")
 ch.market.signal(99)
 ch.market.items(type="strategy")

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cryptohopper"
-version = "0.4.0a1"
+version = "0.4.0a2"
 description = "Official Python SDK for the Cryptohopper API"
 readme = "README.md"
 requires-python = ">=3.10"

src/cryptohopper/_client.py

@@ -201,7 +201,10 @@ def _do_request(
     ) -> Any:
         url = f"{self.base_url}{path if path.startswith('/') else '/' + path}"
         headers = {
-            "Authorization": f"Bearer {self._api_key}",
+            # Cryptohopper Public API v1 uses `access-token: <token>`, not the
+            # OAuth2-conventional `Authorization: Bearer <token>`. The gateway
+            # in front of the API rejects Bearer with a SigV4 parse error.
+            "access-token": self._api_key,
             "User-Agent": self._user_agent(),
             "Accept": "application/json",
         }

src/cryptohopper/_version.py

@@ -1 +1 @@
-CURRENT_VERSION = "0.4.0a1"
+CURRENT_VERSION = "0.4.0a2"

tests/test_client.py

@@ -21,7 +21,8 @@ def test_bearer_user_agent_and_data_unwrap(
 
     req = httpx_mock.get_request()
     assert req is not None
-    assert req.headers["Authorization"] == "Bearer ch_test"
+    assert req.headers["access-token"] == "ch_test"
+    assert "Authorization" not in req.headers
     assert req.headers["User-Agent"] == f"cryptohopper-sdk-python/{CURRENT_VERSION}"
     assert "x-api-app-key" not in req.headers