[mrchtr]

Proposed Changes?

whoami failed with "Authentication failed" right after a successful haystack-enterprise login.

Cause: whoami used a sync httpx.get(..., auth=OAuthAuth), but OAuthAuth only implements async_auth_flow. Sync httpx falls back to the base auth_flow, which attaches nothing, so no bearer token was sent. API-key auth was unaffected because the key goes in the header directly.

Fix: whoami now fetches workspaces through httpx.AsyncClient (new _list_workspaces helper), the same path the rest of the SDK uses, so the token is sent and refreshed on expiry or 401.

How did you test it?

• New test_whoami_with_login_session: saves login credentials, no API_KEY, and asserts the bearer token reaches the transport. It failed before the fix.
• test_whoami now asserts the API-key header at the transport level.
• make tests-unit (770 passed), make types, make all-fix.
• Manual: installed the branch, ran haystack-enterprise login and then whoami. It reports "with a login session" and exits 0.

Notes for the reviewer

I didn't add a sync_auth_flow to OAuthAuth, because whoami is its only sync caller.

Checklist

• I have updated the referenced issue with new insights and changes
• If this is a code change, I have added unit tests
• I've used the conventional commit specification for my PR title
• I updated the docstrings
• If this is a code change, I added meaningful logs and prepared Datadog visualizations and alerts

🤖 Generated with Claude Code

https://claude.ai/code/session_01P3nCYHqG2BQyGPLbAfzLqA

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack_enterprise_sdk
cli.py					517-519
Project Total

This report was generated by python-coverage-comment-action