feat(sdk): validate E2B API key format client-side

[mishushakov]

Summary

• Both JS and Python SDKs now validate that the configured E2B API key matches e2b_ followed by 40 hex characters (mirroring the server-side check in infra/.../keys/key.go) and throw AuthenticationError / AuthenticationException with an example token (e2b_0000…) and a link to the API Keys dashboard tab.
• Validation runs inside ApiClient / ApiClient.__init__ whenever an API key is present, so callers get immediate, actionable feedback instead of a generic 401 from the server.
• Added unit tests (validateApiKey.test.ts, test_validate_api_key.py) and updated existing fixtures that used placeholder keys like 'test-key' / 'base-api-key' to use the valid format.

Test plan

• pnpm run format, pnpm run lint, pnpm run typecheck
• pnpm exec vitest run tests/api/validateApiKey.test.ts tests/api/handleApiError.test.ts tests/sandbox/abortSignal.test.ts tests/template/abortSignal.test.ts tests/sandbox/configPropagation.test.ts tests/connectionConfig.test.ts
• poetry run pytest tests/test_validate_api_key.py tests/test_api_client_transport.py tests/sync/sandbox_sync/test_config_propagation.py tests/async/sandbox_async/test_config_propagation.py tests/test_connection_config.py

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds pre-request format checks only; valid keys behave the same, and invalid keys fail earlier with clearer errors.

Overview
The JS and Python SDKs now reject malformed E2B API keys before any HTTP call by checking that the key matches e2b_ plus lowercase hex. Invalid keys raise AuthenticationError / AuthenticationException with an example token and a link to the dashboard API Keys tab.

Validation runs in ApiClient whenever an apiKey is set on the connection config. Dedicated unit tests were added, and existing tests that used placeholder keys like test-key were switched to a shared well-formed TEST_API_KEY / test_api_key fixture.

^{Reviewed by Cursor Bugbot for commit 5e02401. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 5e02401

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
e2b	Patch
@e2b/python-sdk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Package Artifacts

Built from 257b3ad. Download artifacts from this workflow run.

JS SDK (e2b@2.26.1-mishushakov-sdk-api-key-validation.0):

npm install ./e2b-2.26.1-mishushakov-sdk-api-key-validation.0.tgz

CLI (@e2b/cli@2.10.3-mishushakov-sdk-api-key-validation.0):

npm install ./e2b-cli-2.10.3-mishushakov-sdk-api-key-validation.0.tgz

Python SDK (e2b==2.24.0+mishushakov-sdk-api-key-validation):

pip install ./e2b-2.24.0+mishushakov.sdk.api.key.validation-py3-none-any.whl

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 043f723. Configure here.}

[matthewlouisbrockman]

looks fine; it looks like we have the base api key though, can we use that const everywhere if possible instead of hardcoding it in places?