Repository: logto-io/logto
File: packages/api/src/management.ts (TypeScript)

Code before:
/**
 * Returns the base URL for the Management API based on the tenant ID.
 * @param tenantId The tenant ID to construct the base URL.
 * @returns The base URL for the Management API.
 */
export const getBaseUrl = (tenantId: string) => `https://${tenantId}.logto.app`;

/**
 * Returns the API indicator for the Management API based on the tenant ID.
 * This will be used as the `resource` parameter when requesting an access token.
 * @param tenantId The tenant ID to construct the API indicator.
 * @returns The API indicator for the Management API.
 */
export const getManagementApiIndicator = (tenantId: string) => `${getBaseUrl(tenantId)}/api`;

/**
 * The scope used for accessing all endpoints of the Management API.
 * This is used when requesting an access token for the Management API.
 */
export const allScope = 'all';

/**
 * Creates an API client with custom token authentication.
 *
 * This function is useful when you need full control over the authentication flow,
 * such as when using organization tokens or other custom token sources.
 *
 * The client automatically skips authentication for `.well-known` endpoints.
 *
 * @param options The options including base URL and token getter function.
 * @returns A configured API client with type-safe methods.
 * @example
 * ```ts
 * import { createApiClient } from '@logto/api/management';
 *
 * const client = createApiClient({
 *   baseUrl: 'https://my-tenant.logto.app',
 *   getToken: async () => getYourToken(),
 * });
 *
 * const response = await client.GET('/api/applications/{id}', {
 *   params: { path: { id: 'app-id' } },
 * });
 * ```
 */
export function createApiClient(options: CreateApiClientOptions): Client<paths> {
  const { baseUrl, getToken } = options;
  const client = createClient<paths>({ baseUrl });

  client.use({
    async onRequest({ schemaPath, request }) {

Review comment (security):
```suggestion
 * This function is useful when you need full control over the authentication flow,
 * such as custom token sources.
```

Code after:
/**
 * Returns the base URL for the Management API based on the tenant ID.
 * @param tenantId The tenant ID to construct the base URL.
 * @returns The base URL for the Management API.
 */
export const getBaseUrl = (tenantId: string) => `https://${tenantId}.logto.app`;

/**
 * Returns the API indicator for the Management API based on the tenant ID.
 * This will be used as the `resource` parameter when requesting an access token.
 * @param tenantId The tenant ID to construct the API indicator.
 * @returns The API indicator for the Management API.
 */
export const getManagementApiIndicator = (tenantId: string) => `${getBaseUrl(tenantId)}/api`;

/**
 * The scope used for accessing all endpoints of the Management API.
 * This is used when requesting an access token for the Management API.
 */
export const allScope = 'all';

/**
 * Creates an API client with custom token authentication.
 *
 * This function is useful when you need full control over the authentication flow,
 * such as custom token sources.
 *
 * The client automatically skips authentication for `.well-known` endpoints.
 *
 * @param options The options including base URL and token getter function.
 * @returns A configured API client with type-safe methods.
 * @example
 * ```ts
 * import { createApiClient } from '@logto/api/management';
 *
 * const client = createApiClient({
 *   baseUrl: 'https://my-tenant.logto.app',
 *   getToken: async () => getYourToken(),
 * });
 *
 * const response = await client.GET('/api/applications/{id}', {
 *   params: { path: { id: 'app-id' } },
 * });
 * ```
 */
export function createApiClient(options: CreateApiClientOptions): Client<paths> {
  const { baseUrl, getToken } = options;
  const client = createClient<paths>({ baseUrl });

  client.use({
    async onRequest({ schemaPath, request }) {