From 1b99e78d7d9010a0859719656b156c92b3798d82 Mon Sep 17 00:00:00 2001
From: mehnoorsiddiqui <ayaankhan7532@gmail.com>
Date: Fri, 6 Nov 2026 12:06:38 +0500
Subject: [PATCH] feat(sdk): accept --auth-key in sdk publish

sdk publish now takes -k, --auth-key like the other API commands. The key
is used for the publishing profiles lookup, SDK generation, the upload and
the publish-log polling, and it takes precedence over the stored login.
Passing only --auth-key (and/or --git-init) still runs guided mode.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                                     |   8 +-
 src/actions/sdk/publish.ts                    |  14 +-
 src/actions/sdk/publish/interactive.ts        |  10 +-
 src/actions/sdk/publish/non-interactive.ts    |  10 +-
 src/commands/sdk/publish.ts                   |  25 ++--
 .../services/publishing-api-service.ts        |  27 ++--
 test/actions/sdk/publish.test.ts              |  41 +++++-
 test/commands/sdk/publish-flags.test.ts       |  24 +++-
 .../services/publishing-api-service.test.ts   | 120 ++++++++++++++++++
 9 files changed, 235 insertions(+), 44 deletions(-)
 create mode 100644 test/infrastructure/services/publishing-api-service.test.ts

diff --git a/README.md b/README.md
index a1bf9676..dcb54fa6 100644
--- a/README.md
+++ b/README.md
@@ -455,7 +455,8 @@ Generate and publish an SDK to a package registry and/or source repository
 ```
 USAGE
   $ apimatic sdk publish [-p <value>] [-v <value>] [-d <value>] [-l csharp|java|php|python|ruby|typescript|go]
-    [-f] [-i <value>] [--publish-type package|sourcecode...] [--dry-run] [--stability stable|beta] [--git-init]
+    [-f] [-i <value>] [--publish-type package|sourcecode...] [--dry-run] [--stability stable|beta] [--git-init] [-k
+    <value>]
 
 FLAGS
   -d, --destination=<value>       [default: <input>/sdk/<language>] path where the sdk will be generated.
@@ -463,6 +464,7 @@ FLAGS
                                   be merged is replaced, with a warning.
   -i, --input=<value>             [default: ./] path to the parent directory containing the 'src' directory, which
                                   includes API specifications and configuration files.
+  -k, --auth-key=<value>          override current authentication state with an authentication key.
   -l, --language=<option>         Language of the SDK to generate and publish.
                                   <options: csharp|java|php|python|ruby|typescript|go>
   -p, --profile-id=<value>        Id of the publishing profile to use.
@@ -480,8 +482,8 @@ DESCRIPTION
   Generate and publish an SDK to a package registry and/or source repository
 
   Generate and publish an SDK using a publishing profile configured in the APIMatic App. Requires an input directory
-  containing the API specification. Run it with no flags, or with only --git-init, for guided mode, or pass flags for
-  CI/CD. When you pass flags, --profile-id, --language, --version, and --publish-type are required.
+  containing the API specification. Run it with no flags, or with only --git-init or --auth-key, for guided mode, or
+  pass flags for CI/CD. When you pass flags, --profile-id, --language, --version, and --publish-type are required.
   Your changes to the SDK are merged before it is published, as sdk generate does with git 2.38 or later: with flags,
   always; in guided mode, add --git-init. Nothing is published while conflicts are left to resolve.
 
diff --git a/src/actions/sdk/publish.ts b/src/actions/sdk/publish.ts
index 5abb71a5..5686593f 100644
--- a/src/actions/sdk/publish.ts
+++ b/src/actions/sdk/publish.ts
@@ -26,7 +26,11 @@ export class SdkPublishAction {
   private readonly launcherService: LauncherService = new LauncherService();
   private readonly gitService: GitService = new GitService();
 
-  public constructor(private readonly configDir: DirectoryPath, private readonly commandMetadata: CommandMetadata) {}
+  public constructor(
+    private readonly configDir: DirectoryPath,
+    private readonly commandMetadata: CommandMetadata,
+    private readonly authKey: string | null = null
+  ) {}
 
   public readonly execute = async (
     project: ProjectContext,
@@ -54,7 +58,7 @@ export class SdkPublishAction {
         await packageSettingsContext.writeConfiguration(packageConfigurationData, language);
       }
 
-      const sdkGenerateAction = new GenerateAction(this.configDir, this.commandMetadata);
+      const sdkGenerateAction = new GenerateAction(this.configDir, this.commandMetadata, this.authKey);
       const sdkGenerationResult = await sdkGenerateAction.execute(
         project,
         sdkDirectory,
@@ -95,7 +99,8 @@ export class SdkPublishAction {
           semVersion,
           publishType,
           this.configDir,
-          this.commandMetadata.shell
+          this.commandMetadata.shell,
+          this.authKey
         )
       );
 
@@ -125,7 +130,8 @@ export class SdkPublishAction {
       this.publishingApiService.getSdkPublishingLog(
         publishingInfo.publishLogId,
         this.configDir,
-        this.commandMetadata.shell
+        this.commandMetadata.shell,
+        this.authKey
       )
     );
 
diff --git a/src/actions/sdk/publish/interactive.ts b/src/actions/sdk/publish/interactive.ts
index f2aa91d3..a8255990 100644
--- a/src/actions/sdk/publish/interactive.ts
+++ b/src/actions/sdk/publish/interactive.ts
@@ -17,7 +17,11 @@ export class SdkPublishInteractiveAction {
   private readonly prompts: SdkPublishInteractivePrompts = new SdkPublishInteractivePrompts();
   private readonly publishingApiService: PublishingApiService = new PublishingApiService();
 
-  public constructor(private readonly configDir: DirectoryPath, private readonly commandMetadata: CommandMetadata) {}
+  public constructor(
+    private readonly configDir: DirectoryPath,
+    private readonly commandMetadata: CommandMetadata,
+    private readonly authKey: string | null = null
+  ) {}
 
   public readonly execute = async (
     defaultProjectDirectory: DirectoryPath,
@@ -35,7 +39,7 @@ export class SdkPublishInteractiveAction {
     const project = ProjectContext.in(workingDirectory);
 
     const publishingProfilesResponse = await this.prompts.getPublishingProfiles(
-      this.publishingApiService.getPublishingProfiles(this.configDir, this.commandMetadata.shell)
+      this.publishingApiService.getPublishingProfiles(this.configDir, this.commandMetadata.shell, this.authKey)
     );
     if (publishingProfilesResponse.isErr()) {
       this.prompts.getPublishingProfilesServiceError(publishingProfilesResponse.error);
@@ -126,7 +130,7 @@ export class SdkPublishInteractiveAction {
     }
 
     const publishingProfileId = ProfileId.createFromPublishingProfileItem(publishingProfileItem);
-    const publishResult = await new SdkPublishAction(this.configDir, this.commandMetadata).execute(
+    const publishResult = await new SdkPublishAction(this.configDir, this.commandMetadata, this.authKey).execute(
       project,
       sdkDirectory,
       language,
diff --git a/src/actions/sdk/publish/non-interactive.ts b/src/actions/sdk/publish/non-interactive.ts
index 79d4876c..7205d756 100644
--- a/src/actions/sdk/publish/non-interactive.ts
+++ b/src/actions/sdk/publish/non-interactive.ts
@@ -18,7 +18,11 @@ export class SdkPublishNonInteractiveAction {
   private readonly prompts: SdkPublishNonInteractivePrompts = new SdkPublishNonInteractivePrompts();
   private readonly publishingApiService: PublishingApiService = new PublishingApiService();
 
-  public constructor(private readonly configDir: DirectoryPath, private readonly commandMetadata: CommandMetadata) {}
+  public constructor(
+    private readonly configDir: DirectoryPath,
+    private readonly commandMetadata: CommandMetadata,
+    private readonly authKey: string | null = null
+  ) {}
 
   public readonly execute = async (
     project: ProjectContext,
@@ -63,7 +67,7 @@ export class SdkPublishNonInteractiveAction {
     }
 
     const publishingProfilesResponse = await this.prompts.getPublishingProfiles(
-      this.publishingApiService.getPublishingProfiles(this.configDir, this.commandMetadata.shell)
+      this.publishingApiService.getPublishingProfiles(this.configDir, this.commandMetadata.shell, this.authKey)
     );
     if (publishingProfilesResponse.isErr()) {
       this.prompts.getPublishingProfilesServiceError(publishingProfilesResponse.error);
@@ -108,7 +112,7 @@ export class SdkPublishNonInteractiveAction {
       stability: stability.chosenLevel()
     });
     // A run with flags is the CI flow: it never waits on a question, whether a terminal is attached or not, and always keeps the SDK's edits.
-    const publishResult = await new SdkPublishAction(this.configDir, this.commandMetadata).execute(
+    const publishResult = await new SdkPublishAction(this.configDir, this.commandMetadata, this.authKey).execute(
       project,
       sdkDirectory,
       language,
diff --git a/src/commands/sdk/publish.ts b/src/commands/sdk/publish.ts
index f13b3b44..40b99bf7 100644
--- a/src/commands/sdk/publish.ts
+++ b/src/commands/sdk/publish.ts
@@ -1,4 +1,4 @@
-import { Command, Flags } from '@oclif/core';
+import { Command, Flags, Interfaces } from '@oclif/core';
 import { DirectoryPath } from '../../types/file/directoryPath.js';
 import { FlagsProvider } from '../../types/flags-provider.js';
 import { Language, Stability } from '../../types/sdk/generate.js';
@@ -15,7 +15,7 @@ import { SdkPublishNonInteractiveAction } from '../../actions/sdk/publish/non-in
 export default class SdkPublish extends Command {
   static readonly summary = 'Generate and publish an SDK to a package registry and/or source repository';
 
-  static readonly description = `Generate and publish an SDK using a publishing profile configured in the APIMatic App. Requires an input directory containing the API specification. Run it with no flags, or with only --git-init, for guided mode, or pass flags for CI/CD. When you pass flags, --profile-id, --language, --version, and --publish-type are required.
+  static readonly description = `Generate and publish an SDK using a publishing profile configured in the APIMatic App. Requires an input directory containing the API specification. Run it with no flags, or with only --git-init or --auth-key, for guided mode, or pass flags for CI/CD. When you pass flags, --profile-id, --language, --version, and --publish-type are required.
 Your changes to the SDK are merged before it is published, as sdk generate does with git 2.38 or later: with flags, always; in guided mode, add --git-init. Nothing is published while conflicts are left to resolve.`;
 
   static readonly cmdTxt = format.cmd('apimatic', 'sdk', 'publish');
@@ -56,7 +56,8 @@ Your changes to the SDK are merged before it is published, as sdk generate does
       default: false,
       description:
         "In guided mode, make the SDK directory a git repository when it isn't one of its own, so your changes to the SDK are kept. With flags, sdk publish always does this."
-    })
+    }),
+    ...FlagsProvider.authKey
   };
 
   static examples = [
@@ -80,9 +81,9 @@ Your changes to the SDK are merged before it is published, as sdk generate does
     )}`
   ];
 
-  /** Guided mode is asked for by no flags, or `--git-init` alone. */
-  static isGuided(argv: readonly string[]): boolean {
-    return argv.every((arg) => arg === '--git-init');
+  /** Guided mode is asked for by no flags, or only `--git-init` and `--auth-key`. */
+  static isGuided(raw: Interfaces.ParserOutput['raw']): boolean {
+    return raw.every((token) => token.type === 'flag' && (token.flag === 'git-init' || token.flag === 'auth-key'));
   }
 
   async run() {
@@ -97,12 +98,14 @@ Your changes to the SDK are merged before it is published, as sdk generate does
         'publish-type': publishType,
         'dry-run': dryRun,
         stability,
-        'git-init': gitInit
-      }
+        'git-init': gitInit,
+        'auth-key': authKey
+      },
+      raw
     } = await this.parse(SdkPublish);
 
     const publishTypes = [...new Set(publishType)] as PublishType[];
-    const interactive = SdkPublish.isGuided(this.argv);
+    const interactive = SdkPublish.isGuided(raw);
     const commandMetadata: CommandMetadata = {
       commandName: SdkPublish.id,
       shell: this.config.shell
@@ -134,12 +137,12 @@ Your changes to the SDK are merged before it is published, as sdk generate does
     const sdkDirectory = destination === undefined ? undefined : DirectoryPath.fromUserInput(destination);
     intro('Publish SDK');
     const result = interactive
-      ? await new SdkPublishInteractiveAction(configDir, commandMetadata).execute(
+      ? await new SdkPublishInteractiveAction(configDir, commandMetadata, authKey).execute(
           DirectoryPath.createInput(input),
           gitInit,
           onPublishSdkError
         )
-      : await new SdkPublishNonInteractiveAction(configDir, commandMetadata).execute(
+      : await new SdkPublishNonInteractiveAction(configDir, commandMetadata, authKey).execute(
           project,
           sdkDirectory,
           language as Language,
diff --git a/src/infrastructure/services/publishing-api-service.ts b/src/infrastructure/services/publishing-api-service.ts
index b1c23595..20450a14 100644
--- a/src/infrastructure/services/publishing-api-service.ts
+++ b/src/infrastructure/services/publishing-api-service.ts
@@ -25,8 +25,7 @@ export class PublishingApiService {
     authKey: string | null = null
   ): Promise<Result<PublishingProfileItem[], ServiceError>> {
     const authInfo: AuthInfo | null = await getAuthInfo(configDir.toString());
-    // `auth logout` blanks config.json rather than deleting it, so a logged-out user
-    // still has a non-null AuthInfo with an empty key — check the key, not the object.
+    // `auth logout` blanks config.json rather than deleting it, so check the key, not the AuthInfo.
     const token = authKey || authInfo?.authKey;
     if (!token) {
       return err(ServiceError.unauthorizedWithHint(null));
@@ -51,25 +50,25 @@ export class PublishingApiService {
     packageVersion: SemVersion,
     publishType: PublishType[],
     configDir: DirectoryPath,
-    shell: string
+    shell: string,
+    authKey: string | null = null
   ): Promise<Result<PublishingInfo, ServiceError>> {
     const authInfo: AuthInfo | null = await getAuthInfo(configDir.toString());
-    // `auth logout` blanks config.json rather than deleting it, so a logged-out user
-    // still has a non-null AuthInfo with an empty key — check the key, not the object.
-    if (!authInfo?.authKey) {
+    // `auth logout` blanks config.json rather than deleting it, so check the key, not the AuthInfo.
+    const token = authKey || authInfo?.authKey;
+    if (!token) {
       return err(ServiceError.unauthorizedWithHint(null));
     }
     const sdkFileStream = await this.fileService.getStream(sdkFilePath);
 
     try {
-      const token = authInfo.authKey;
       const formData = new FormData();
       formData.append('file', sdkFileStream);
       formData.append('packageVersion', packageVersion.toString());
 
-      // If both package and source code publishing are not selected, publishType array will contain only one of them, so we need to specify which one to the API. 
+      // If both package and source code publishing are not selected, publishType array will contain only one of them, so we need to specify which one to the API.
       // If both are selected, we will omit this field as API defaults to both types being selected.
-      if (publishType.length !== 2) { 
+      if (publishType.length !== 2) {
         formData.append('publishType', publishType[0]);
       }
 
@@ -109,17 +108,17 @@ export class PublishingApiService {
   public async getSdkPublishingLog(
     publishingLogId: string,
     configDir: DirectoryPath,
-    shell: string
+    shell: string,
+    authKey: string | null = null
   ): Promise<Result<PublishLogItem, ServiceError>> {
     const authInfo: AuthInfo | null = await getAuthInfo(configDir.toString());
-    // `auth logout` blanks config.json rather than deleting it, so a logged-out user
-    // still has a non-null AuthInfo with an empty key — check the key, not the object.
-    if (!authInfo?.authKey) {
+    // `auth logout` blanks config.json rather than deleting it, so check the key, not the AuthInfo.
+    const token = authKey || authInfo?.authKey;
+    if (!token) {
       return err(ServiceError.unauthorizedWithHint(null));
     }
 
     try {
-      const token = authInfo.authKey;
       const response = await this.axiosInstance(shell, token).get(`/publish-logs/${publishingLogId}`);
 
       if (response.status === 200) {
diff --git a/test/actions/sdk/publish.test.ts b/test/actions/sdk/publish.test.ts
index 5f09c828..1e7538c4 100644
--- a/test/actions/sdk/publish.test.ts
+++ b/test/actions/sdk/publish.test.ts
@@ -19,6 +19,7 @@ import { FileProblem } from '../../../src/types/file/file-problem.js';
 import { GitContext } from '../../../src/types/git-context.js';
 import { ProjectContext } from '../../../src/types/project-context.js';
 import { PublishingProfileItem, PublishType } from '../../../src/types/publish-api/publishing-profile-item.js';
+import { PublishLogItem } from '../../../src/types/publish-api/publish-log.js';
 import { ProfileId } from '../../../src/types/publish/profile-id.js';
 import { PublishingProfile } from '../../../src/types/publish/publishing-profile.js';
 import { SemVersion } from '../../../src/types/publish/version.js';
@@ -34,6 +35,7 @@ const COMMAND_METADATA: CommandMetadata = { commandName: 'sdk publish', shell: '
 describe('SdkPublishAction', () => {
   let root: string;
   let generates: (files: Files) => Promise<void>;
+  let generateSdk: sinon.SinonStub;
   let onPublishSdkError: sinon.SinonStub;
   let restoreConfig: () => void;
 
@@ -63,7 +65,7 @@ describe('SdkPublishAction', () => {
 
   beforeEach(async () => {
     root = fs.mkdtempSync(path.join(os.tmpdir(), 'sdk-publish-'));
-    ({ generates } = stubSdkGeneration(root));
+    ({ generates, generateSdk } = stubSdkGeneration(root));
     await generates({ 'README.md': '# sdk' });
     onPublishSdkError = sinon.stub();
     restoreConfig = emptyGlobalGitConfig(root);
@@ -115,6 +117,43 @@ describe('SdkPublishAction', () => {
     expect(fs.existsSync(path.join(sdk().toString(), 'node_modules', 'dep.js'))).to.be.true;
   });
 
+  it('uses the auth key it was given to generate, upload and follow the publish', async () => {
+    quietGeneration();
+    sinon.stub(SdkPublishPrompts.prototype, 'publishSdk').callsFake((fn) => fn);
+    sinon.stub(SdkPublishPrompts.prototype, 'publishingRunningNotice');
+    sinon.stub(SdkPublishPrompts.prototype, 'publishingLogsMessage');
+    sinon.stub(SdkPublishPrompts.prototype, 'pollPublishingStatus').callsFake(async (poll) => {
+      await poll();
+      return 'succeeded';
+    });
+    const publishSdkPackage = uploads([]);
+    const getSdkPublishingLog = sinon
+      .stub(PublishingApiService.prototype, 'getSdkPublishingLog')
+      .resolves(ok({} as PublishLogItem));
+
+    const result = await new SdkPublishAction(new DirectoryPath(root), COMMAND_METADATA, 'flag-key').execute(
+      ProjectContext.in(new DirectoryPath(root)),
+      sdk(),
+      Language.PYTHON,
+      Stability.STABLE,
+      [PublishType.PackagePublishing],
+      true,
+      false,
+      true,
+      ProfileId.tryCreate('profile')._unsafeUnwrap(),
+      SemVersion.tryCreate('1.0.0')._unsafeUnwrap(),
+      withoutPackageSettings,
+      false,
+      'summary',
+      onPublishSdkError
+    );
+
+    expect(result.isSuccess()).to.be.true;
+    expect(generateSdk.firstCall.args[5]).to.equal('flag-key');
+    expect(publishSdkPackage.firstCall.args[7]).to.equal('flag-key');
+    expect(getSdkPublishingLog.firstCall.args[3]).to.equal('flag-key');
+  });
+
   it('generates into the SDK directory on a dry run and opens it, uploading nothing', async () => {
     quietGeneration();
     const dryRunNotice = sinon.stub(SdkPublishPrompts.prototype, 'dryRunNotice');
diff --git a/test/commands/sdk/publish-flags.test.ts b/test/commands/sdk/publish-flags.test.ts
index ee804c6b..ad0d1354 100644
--- a/test/commands/sdk/publish-flags.test.ts
+++ b/test/commands/sdk/publish-flags.test.ts
@@ -52,11 +52,25 @@ describe('sdk publish flags', () => {
     expect(omitted.flags['git-init']).to.be.false;
   });
 
-  it('runs guided with no flags or --git-init alone, and with flags otherwise', () => {
-    expect(SdkPublish.isGuided([])).to.be.true;
-    expect(SdkPublish.isGuided(['--git-init'])).to.be.true;
-    expect(SdkPublish.isGuided(['--git-init', '--dry-run'])).to.be.false;
-    expect(SdkPublish.isGuided(['--language', 'python'])).to.be.false;
+  it('runs guided with no flags or only --git-init and --auth-key, and with flags otherwise', async () => {
+    const guided = async (argv: string[]) => SdkPublish.isGuided((await parse(argv)).raw);
+
+    expect(await guided([])).to.be.true;
+    expect(await guided(['--git-init'])).to.be.true;
+    expect(await guided(['--auth-key', 'key'])).to.be.true;
+    expect(await guided(['--auth-key=key'])).to.be.true;
+    expect(await guided(['-k', 'key'])).to.be.true;
+    expect(await guided(['--git-init', '-k', 'key'])).to.be.true;
+    expect(await guided(['--git-init', '--dry-run'])).to.be.false;
+    expect(await guided(['-k', 'key', '--language', 'python'])).to.be.false;
+  });
+
+  it('accepts an auth key, long or short', async () => {
+    const long = (await parse(['--auth-key', 'key'])) as never as { flags: Record<string, unknown> };
+    const short = (await parse(['-k', 'key'])) as never as { flags: Record<string, unknown> };
+
+    expect(long.flags['auth-key']).to.equal('key');
+    expect(short.flags['auth-key']).to.equal('key');
   });
 
   it('still parses the flags a publish is actually made of', async () => {
diff --git a/test/infrastructure/services/publishing-api-service.test.ts b/test/infrastructure/services/publishing-api-service.test.ts
new file mode 100644
index 00000000..a484ccb8
--- /dev/null
+++ b/test/infrastructure/services/publishing-api-service.test.ts
@@ -0,0 +1,120 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import nock from 'nock';
+import { expect } from 'chai';
+import { PublishingApiService } from '../../../src/infrastructure/services/publishing-api-service';
+import { ServiceErrorCode } from '../../../src/infrastructure/service-error';
+import { envInfo } from '../../../src/infrastructure/env-info';
+import { DirectoryPath } from '../../../src/types/file/directoryPath';
+import { FileName } from '../../../src/types/file/fileName';
+import { FilePath } from '../../../src/types/file/filePath';
+import { Language } from '../../../src/types/sdk/generate';
+import { PublishType } from '../../../src/types/publish-api/publishing-profile-item';
+import { ProfileId } from '../../../src/types/publish/profile-id';
+import { SemVersion } from '../../../src/types/publish/version';
+
+const PUBLISHING_URL = 'http://publishing.test';
+const PROFILE_ID = 'a1b2c3d4e5f6a1b2c3d4e5f6';
+const LOG = { publishLogId: 'log', publishingLogUrl: 'https://logs.test/log' };
+
+describe('PublishingApiService', () => {
+  const service = new PublishingApiService();
+  let configRoot: string;
+  let configDir: DirectoryPath;
+  let sdkFile: FilePath;
+
+  const storeKey = (authKey: string) =>
+    fs.writeFileSync(path.join(configRoot, 'config.json'), JSON.stringify({ email: 'user@example.com', authKey }));
+
+  const publish = (authKey: string | null = null) =>
+    service.publishSdkPackage(
+      sdkFile,
+      ProfileId.tryCreate(PROFILE_ID)._unsafeUnwrap(),
+      Language.PYTHON,
+      SemVersion.tryCreate('1.0.0')._unsafeUnwrap(),
+      [PublishType.PackagePublishing],
+      configDir,
+      'bash',
+      authKey
+    );
+
+  const clearCachedPublishingUrl = () => {
+    (envInfo.constructor as unknown as { cachedPublishingBaseUrl?: string }).cachedPublishingBaseUrl = undefined;
+  };
+
+  before(() => {
+    process.env.APIMATIC_BASE_URL = `http://api.test;http://auth.test;${PUBLISHING_URL}`;
+    clearCachedPublishingUrl();
+  });
+
+  after(() => {
+    delete process.env.APIMATIC_BASE_URL;
+    clearCachedPublishingUrl();
+  });
+
+  beforeEach(() => {
+    configRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'publishing-api-'));
+    configDir = new DirectoryPath(configRoot);
+    fs.writeFileSync(path.join(configRoot, 'sdk.zip'), 'zip');
+    sdkFile = new FilePath(configDir, new FileName('sdk.zip'));
+    nock.cleanAll();
+  });
+
+  afterEach(() => {
+    fs.rmSync(configRoot, { recursive: true, force: true });
+    nock.cleanAll();
+  });
+
+  it('publishes with the flag key when nobody is logged in', async () => {
+    const scope = nock(PUBLISHING_URL)
+      .matchHeader('Authorization', 'X-Auth-Key flag-key')
+      .post(`/publish/${PROFILE_ID}/${Language.PYTHON}`)
+      .reply(200, LOG);
+
+    expect((await publish('flag-key'))._unsafeUnwrap()).to.deep.equal(LOG);
+    expect(scope.isDone()).to.be.true;
+  });
+
+  it('prefers the flag key over the stored one when publishing', async () => {
+    storeKey('stored-key');
+    const scope = nock(PUBLISHING_URL)
+      .matchHeader('Authorization', 'X-Auth-Key flag-key')
+      .post(`/publish/${PROFILE_ID}/${Language.PYTHON}`)
+      .reply(200, LOG);
+
+    expect((await publish('flag-key')).isOk()).to.be.true;
+    expect(scope.isDone()).to.be.true;
+  });
+
+  it('publishes with the stored key when no flag is given', async () => {
+    storeKey('stored-key');
+    const scope = nock(PUBLISHING_URL)
+      .matchHeader('Authorization', 'X-Auth-Key stored-key')
+      .post(`/publish/${PROFILE_ID}/${Language.PYTHON}`)
+      .reply(200, LOG);
+
+    expect((await publish()).isOk()).to.be.true;
+    expect(scope.isDone()).to.be.true;
+  });
+
+  it('refuses to publish with neither a flag key nor a login', async () => {
+    expect((await publish())._unsafeUnwrapErr().code).to.equal(ServiceErrorCode.UnAuthorized);
+  });
+
+  it('reads the publishing log with the flag key when nobody is logged in', async () => {
+    const scope = nock(PUBLISHING_URL)
+      .matchHeader('Authorization', 'X-Auth-Key flag-key')
+      .get('/publish-logs/log')
+      .reply(200, { status: 'Succeeded' });
+
+    expect((await service.getSdkPublishingLog('log', configDir, 'bash', 'flag-key')).isOk()).to.be.true;
+    expect(scope.isDone()).to.be.true;
+  });
+
+  it('refuses to read the publishing log with neither a flag key nor a login', async () => {
+    const result = await service.getSdkPublishingLog('log', configDir, 'bash');
+
+    expect(result._unsafeUnwrapErr().code).to.equal(ServiceErrorCode.UnAuthorized);
+  });
+});