refactor: use Authorization header for API authentication

src/geocodio/client.py

@@ -77,7 +77,7 @@ def geocode(
             limit: Optional[int] = None,
             country: Optional[str] = None,
     ) -> GeocodingResponse:
-        params: Dict[str, Union[str, int]] = {"api_key": self.api_key}
+        params: Dict[str, Union[str, int]] = {}
         if fields:
             params["fields"] = ",".join(fields)
         if limit:
@@ -131,7 +131,7 @@ def reverse(
             fields: Optional[List[str]] = None,
             limit: Optional[int] = None,
     ) -> GeocodingResponse:
-        params: Dict[str, Union[str, int]] = {"api_key": self.api_key}
+        params: Dict[str, Union[str, int]] = {}
         if fields:
             params["fields"] = ",".join(fields)
         if limit:
@@ -170,7 +170,7 @@ def _request(
             self,
             method: str,
             endpoint: str,
-            params: dict,
+            params: Optional[dict] = None,
             json: Optional[dict] = None,
             files: Optional[dict] = None,
             timeout: Optional[float] = None,
@@ -183,8 +183,11 @@ def _request(
         if timeout is None:
             timeout = self.single_timeout
 
+        # Set up authorization header
+        headers = {"Authorization": f"Bearer {self.api_key}"}
+
         logger.debug(f"Using timeout: {timeout}s")
-        resp = self._http.request(method, endpoint, params=params, json=json, files=files, timeout=timeout)
+        resp = self._http.request(method, endpoint, params=params, json=json, files=files, headers=headers, timeout=timeout)
 
         logger.debug(f"Response status code: {resp.status_code}")
         logger.debug(f"Response headers: {resp.headers}")
@@ -289,9 +292,7 @@ def create_list(
             AuthenticationError: If the API key is invalid.
             GeocodioServerError: If the server encounters an error.
         """
-        # @TODO we repeat building the params here; prob should move the API key
-        #    to the self._request() method.
-        params: Dict[str, Union[str, int]] = {"api_key": self.api_key}
+        params: Dict[str, Union[str, int]] = {}
         endpoint = f"{self.BASE_PATH}/lists"
 
         if not file:
@@ -321,7 +322,7 @@ def get_lists(self) -> PaginatedResponse:
         Returns:
             A ListResponse object containing all lists.
         """
-        params: Dict[str, Union[str, int]] = {"api_key": self.api_key}
+        params: Dict[str, Union[str, int]] = {}
         endpoint = f"{self.BASE_PATH}/lists"
 
         response = self._request("GET", endpoint, params, timeout=self.list_timeout)
@@ -356,7 +357,7 @@ def get_list(self, list_id: str) -> ListResponse:
         Returns:
             A ListResponse object containing the retrieved list.
         """
-        params: Dict[str, Union[str, int]] = {"api_key": self.api_key}
+        params: Dict[str, Union[str, int]] = {}
         endpoint = f"{self.BASE_PATH}/lists/{list_id}"
 
         response = self._request("GET", endpoint, params, timeout=self.list_timeout)
@@ -369,7 +370,7 @@ def delete_list(self, list_id: str) -> None:
         Args:
             list_id: The ID of the list to delete.
         """
-        params: Dict[str, Union[str, int]] = {"api_key": self.api_key}
+        params: Dict[str, Union[str, int]] = {}
         endpoint = f"{self.BASE_PATH}/lists/{list_id}"
 
         self._request("DELETE", endpoint, params, timeout=self.list_timeout)
@@ -538,7 +539,7 @@ def download(self, list_id: str, filename: Optional[str] = None) -> str | bytes:
         Raises:
             GeocodioServerError if the list is still processing or another error occurs.
         """
-        params = {"api_key": self.api_key}
+        params = {}
         endpoint = f"{self.BASE_PATH}/lists/{list_id}/download"
 
         response: httpx.Response = self._request("GET", endpoint, params, timeout=self.list_timeout)

tests/unit/test_errors.py

@@ -9,7 +9,8 @@ def _add_err(httpx_mock, status_code):
     # this should actually make the request and see and error response
     # but we are mocking it here for testing purposes
     httpx_mock.add_response(
-        url=httpx.URL("https://api.test/v1.9/geocode", params={"api_key": "TEST_KEY", "q": "bad input"}),
+        url=httpx.URL("https://api.test/v1.9/geocode", params={"q": "bad input"}),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
         json={"error": "boom"},
         status_code=status_code,
     )

tests/unit/test_geocode.py

@@ -57,7 +57,8 @@ def response_callback(request):
 
     httpx_mock.add_callback(
         callback=response_callback,
-        url=httpx.URL("https://api.test/v1.9/geocode", params={"api_key": "TEST_KEY", "q": "1109 N Highland St, Arlington, VA"}),
+        url=httpx.URL("https://api.test/v1.9/geocode", params={"q": "1109 N Highland St, Arlington, VA"}),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -139,7 +140,8 @@ def batch_response_callback(request):
 
     httpx_mock.add_callback(
         callback=batch_response_callback,
-        url=httpx.URL("https://api.test/v1.9/geocode", params={"api_key": "TEST_KEY"}),
+        url=httpx.URL("https://api.test/v1.9/geocode"),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -171,11 +173,11 @@ def response_callback(request):
     httpx_mock.add_callback(
         callback=response_callback,
         url=httpx.URL("https://api.test/v1.9/geocode", params={
-            "api_key": "TEST_KEY",
             "street": "1109 N Highland St",
             "city": "Arlington",
             "state": "VA"
         }),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -228,10 +230,10 @@ def response_callback(request):
     httpx_mock.add_callback(
         callback=response_callback,
         url=httpx.URL("https://api.test/v1.9/geocode", params={
-            "api_key": "TEST_KEY",
             "q": "1109 Highland St, Arlington, VA",
             "fields": "timezone,cd"
         }),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -291,10 +293,10 @@ def response_callback(request):
     httpx_mock.add_callback(
         callback=response_callback,
         url=httpx.URL("https://api.test/v1.9/geocode", params={
-            "api_key": "TEST_KEY",
             "q": "1109 Highland St, Arlington, VA",
             "limit": "2"
         }),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -369,7 +371,8 @@ def batch_response_callback(request):
 
     httpx_mock.add_callback(
         callback=batch_response_callback,
-        url=httpx.URL("https://api.test/v1.9/geocode", params={"api_key": "TEST_KEY"}),
+        url=httpx.URL("https://api.test/v1.9/geocode"),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -475,7 +478,8 @@ def batch_response_callback(request):
 
     httpx_mock.add_callback(
         callback=batch_response_callback,
-        url=httpx.URL("https://api.test/v1.9/geocode", params={"api_key": "TEST_KEY", "fields": "timezone,cd"}),
+        url=httpx.URL("https://api.test/v1.9/geocode", params={"fields": "timezone,cd"}),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act

tests/unit/test_reverse.py

@@ -32,7 +32,8 @@ def response_callback(request):
 
     httpx_mock.add_callback(
         callback=response_callback,
-        url=httpx.URL("https://api.test/v1.9/reverse", params={"api_key": "TEST_KEY", "q": "38.886672,-77.094735"}),
+        url=httpx.URL("https://api.test/v1.9/reverse", params={"q": "38.886672,-77.094735"}),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -54,7 +55,7 @@ def test_reverse_batch_coordinates(client, httpx_mock):
 
     def batch_response_callback(request):
         assert request.method == "POST"
-        assert request.url.params["api_key"] == "TEST_KEY"
+        assert request.headers["Authorization"] == "Bearer TEST_KEY"
         return httpx.Response(200, json={
             "results": [
                 {
@@ -109,7 +110,8 @@ def batch_response_callback(request):
 
     httpx_mock.add_callback(
         callback=batch_response_callback,
-        url=httpx.URL("https://api.test/v1.9/reverse", params={"api_key": "TEST_KEY"}),
+        url=httpx.URL("https://api.test/v1.9/reverse"),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -161,10 +163,10 @@ def response_callback(request):
     httpx_mock.add_callback(
         callback=response_callback,
         url=httpx.URL("https://api.test/v1.9/reverse", params={
-            "api_key": "TEST_KEY",
             "q": "38.886672,-77.094735",
             "fields": "timezone,cd"
         }),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -224,10 +226,10 @@ def response_callback(request):
     httpx_mock.add_callback(
         callback=response_callback,
         url=httpx.URL("https://api.test/v1.9/reverse", params={
-            "api_key": "TEST_KEY",
             "q": "38.886672,-77.094735",
             "limit": "2"
         }),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
     )
 
     # Act
@@ -243,9 +245,9 @@ def test_reverse_invalid_coordinate(client, httpx_mock):
     # Arrange: stub the API call with error response
     httpx_mock.add_response(
         url=httpx.URL("https://api.test/v1.9/reverse", params={
-            "api_key": "TEST_KEY",
             "q": "invalid,coordinate"
         }),
+        match_headers={"Authorization": "Bearer TEST_KEY"},
         json={"error": "Invalid coordinate format"},
         status_code=422
     )