feat(sdk): remove client-side API key format validation

[devin-ai-integration]

Summary

Removes client-side API key format validation from the JS and Python SDKs — the server is the source of truth for key validity. The SDK still requires that a key is present (AuthenticationError / AuthenticationException when missing).

• Deleted the e2b_[0-9a-f]+ format validators (validateApiKey() in JS, validate_api_key() in Python) and their calls in ApiClient.
• The validateApiKey / validate_api_key config option is kept but deprecated as a no-op, so existing code keeps compiling/running:

// still accepted, no effect
new Sandbox.create({ apiKey: 'custom-key', validateApiKey: true })

ConnectionConfig(api_key="custom-key", validate_api_key=True)  # no-op

• The E2B_VALIDATE_API_KEY environment variable is no longer read.
• Any non-empty key (including nonstandard formats) is now sent to the server unchanged.

Linear issue: SDK-347

Link to Devin session: https://app.devin.ai/sessions/16e7710ce0e14a8880ddca64d221c350
Requested by: @mishushakov

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[linear-code]

SDK-347

[changeset-bot]

🦋 Changeset detected

Latest commit: 8b4dd68

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
e2b	Minor
@e2b/python-sdk	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[github-actions]

Package Artifacts

Built from 6379a5f. Download artifacts from this workflow run.

JS SDK (e2b@2.45.1-devin-1787328158-remove-api-key-format-validation.0):

npm install ./e2b-2.45.1-devin-1787328158-remove-api-key-format-validation.0.tgz

CLI (@e2b/cli@2.17.2-devin-1787328158-remove-api-key-format-validation.0):

npm install ./e2b-cli-2.17.2-devin-1787328158-remove-api-key-format-validation.0.tgz

Python SDK (e2b==2.45.1+devin.1787328158.remove.api.key.format.validation):

pip install ./e2b-2.45.1+devin.1787328158.remove.api.key.format.validation-py3-none-any.whl

[devin-ai-integration]

TASTE.md review — checked deprecation/compatibility (T-65, T-66, T-67), configuration & trust boundary (T-49, T-50, T-52), cross-language parity (T-1, T-2, T-10), errors (T-57, T-59, T-62) and docstrings (T-69–T-71).

The change itself is exactly what T-52 asks for: the format regex mirrored a backend business rule, so deleting it (while keeping the presence check that produces an actionable AuthenticationError/AuthenticationException) is the right call, and JS/Python are removed symmetrically per T-1. The internal helpers (validateApiKey / validate_api_key, never re-exported from index.ts / e2b/__init__.py) can go without ceremony.

1 violation (3 inline comments, all the same issue): the public validateApiKey / validate_api_key option is deleted outright rather than deprecated. T-65/T-66 want the identifier kept as an ignored, @deprecated-annotated alias with a migration note and removal horizon; today a user who passes validateApiKey: false (the option added precisely for non-default key formats in #1360) gets a TS compile error, and in Python a TypeError from ConnectionConfig.__init__ plus a now-invalid ApiParams key that type checkers flag. If the intent really is a hard break, then it is a breaking change on a 2.x package and the changeset must be major, not minor — that is the third comment.

No other rules looked violated: no leftover E2B_VALIDATE_API_KEY references anywhere in the repo, and no config-precedence (T-49/T-50) fallout since the whole knob is gone.

[claude]

LGTM — straightforward, symmetric removal of client-side API key format validation from both SDKs.

Extended reasoning...

Overview

This PR removes the client-side API key format check (e2b_ + hex regex) from both the JS and Python SDKs: validateApiKey/validate_api_key functions, the validateApiKey/validate_api_key connection option, and the E2B_VALIDATE_API_KEY env var are all deleted. The presence check (key must be non-empty) is untouched — ApiClient still throws AuthenticationError/AuthenticationException when no key is supplied. Changes are mirrored 1:1 across packages/js-sdk and packages/python-sdk, including their pass-through options in ConnectionOpts/ApiParams and SandboxApiOpts, plus corresponding test deletions/additions in both packages.

Security risks

None introduced. The removed check was a client-side format assertion only — it never enforced anything the server didn't already enforce, since the API is the actual trust boundary for key validity. Removing it means malformed keys are now rejected server-side (as a 401) instead of client-side, which is a behavior change but not a security regression. No auth bypass, no new exposure of secrets, no change to how the key is transmitted (still sent as X-API-KEY header, unchanged).

Level of scrutiny

Low-to-moderate. This touches SDK auth-adjacent code, but the change is subtractive and mechanical: delete a regex-based format check and its config plumbing, keep the presence check. No new logic paths, no schema/API surface additions, and it's symmetric across both SDK languages as required by CLAUDE.md.

Other factors

Tests were properly updated (old validateApiKey-specific tests deleted, presence/no-format-check tests added) in both SDKs, and grepping the repo confirms no stray references to the removed option/env var/function remain outside the changeset file. A changeset is included. I independently checked for leftover references to validateApiKey/validate_api_key/E2B_VALIDATE_API_KEY across the repo and found none outside the intended deletions.

[mishushakov]

okay lets only deprecate it

[devin-ai-integration]

Done — the validateApiKey / validate_api_key option is kept as a deprecated no-op in both SDKs (so existing code keeps compiling/running); the format validation itself and the E2B_VALIDATE_API_KEY env var reading remain removed.

[mishushakov]

devin can you check/resolve other comments