TypeScript SDK ExchangeOptions missing apiToken and getCredentials() does not forward it — Metaculus programmatic authentication broken #1384

Gap

The TypeScript SDK ExchangeOptions interface has no apiToken field, and the base Exchange.getCredentials() never includes apiToken in the credentials object sent to the sidecar. The core MetaculusExchange authenticates exclusively via apiToken; without it the sidecar always constructs Metaculus in unauthenticated mode, silently ignoring any rate-limited or private endpoints.

Core

core/src/BaseExchange.ts:386 — ExchangeCredentials declares:

apiToken?: string;

core/src/server/exchange-factory.ts:110–114:

case "metaculus":
    return new MetaculusExchange({
        apiToken: credentials?.apiToken || process.env.METACULUS_API_TOKEN,
    });

credentials?.apiToken is the only credential field Metaculus reads. If it is absent the exchange falls back to env-var only.

TypeScript SDK

sdks/typescript/pmxt/client.ts:231–290 — ExchangeOptions interface has no apiToken field. There is no typed way to supply one.

sdks/typescript/pmxt/client.ts:464–474 — base getCredentials():

protected getCredentials(): ExchangeCredentials | undefined {
    if (!this.apiKey && !this.privateKey) {
        return undefined;
    }
    return {
        apiKey: this.apiKey,
        privateKey: this.privateKey,
        funderAddress: this.proxyAddress,
        signatureType: this.signatureType,
    };
}

apiToken is absent. The Metaculus class at line 3360 has no getCredentials() override. Users of new Metaculus({ /* ... */ }) have no way to pass an API token; the credential payload sent to the sidecar will never contain apiToken, so the sidecar always builds MetaculusExchange without a token.

Python SDK

sdks/python/pmxt/client.py:329,371 — base Exchange.__init__ accepts api_token: Optional[str] and stores it.

sdks/python/pmxt/client.py:555–564 — base _get_credentials_dict() includes:

if self.api_token:
    creds["apiToken"] = self.api_token

Python SDK is correct. Metaculus(api_token="...") works end-to-end.

Evidence

• core/src/BaseExchange.ts:386 — apiToken in ExchangeCredentials
• core/src/server/exchange-factory.ts:110–114 — Metaculus reads credentials?.apiToken
• sdks/typescript/pmxt/client.ts:231–290 — ExchangeOptions has no apiToken
• sdks/typescript/pmxt/client.ts:464–474 — getCredentials() omits apiToken
• sdks/typescript/pmxt/client.ts:3360–3364 — Metaculus class, no getCredentials() override
• sdks/python/pmxt/client.py:329,564 — Python correctly stores and forwards api_token

Impact

TypeScript SDK users authenticating to Metaculus must rely solely on the METACULUS_API_TOKEN environment variable set on the sidecar process. Programmatic credential passing (e.g., multi-tenant apps rotating tokens, testing pipelines, hosted mode) is impossible. There is no compile-time or runtime error; the token is silently absent from every sidecar request.

Found by automated Core-to-SDK surface coverage audit