From 3b06251fb89401ebcc5c90cb7dd4fabf35093381 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 04:04:22 +0000
Subject: [PATCH 1/2] Initial plan


From a7964e1affa8c95cd017cdd220f8ddbcd7316961 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 04:16:18 +0000
Subject: [PATCH 2/2] Fix TrustSignal verification: use x-api-key header
 instead of Authorization: Bearer

Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>
---
 apps/action/dist/index.js       | 2 +-
 docs/integrations/github.md     | 2 +-
 src/trustsignal/client.ts       | 2 +-
 tests/trustsignalClient.test.ts | 6 +++---
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/apps/action/dist/index.js b/apps/action/dist/index.js
index b5b977e..f3f4479 100644
--- a/apps/action/dist/index.js
+++ b/apps/action/dist/index.js
@@ -4176,7 +4176,7 @@ var TrustSignalVerificationClient = class {
           headers: {
             "content-type": "application/json",
             "accept": "application/json",
-            authorization: `Bearer ${this.apiKey}`
+            "x-api-key": this.apiKey
           },
           body: payloadText,
           signal: controller.signal
diff --git a/docs/integrations/github.md b/docs/integrations/github.md
index 452bfe0..d94cbbb 100644
--- a/docs/integrations/github.md
+++ b/docs/integrations/github.md
@@ -99,7 +99,7 @@ jobs:
           TRUSTSIGNAL_API_KEY: ${{ secrets.TRUSTSIGNAL_API_KEY }}
         run: |
           curl -fsSL \
-            -H "Authorization: Bearer ${TRUSTSIGNAL_API_KEY}" \
+            -H "x-api-key: ${TRUSTSIGNAL_API_KEY}" \
             -H "Content-Type: application/json" \
             -d '{
               "repository": "'"${GITHUB_REPOSITORY}"'",
diff --git a/src/trustsignal/client.ts b/src/trustsignal/client.ts
index 6924197..2167a1c 100644
--- a/src/trustsignal/client.ts
+++ b/src/trustsignal/client.ts
@@ -57,7 +57,7 @@ export class TrustSignalVerificationClient {
           headers: {
             "content-type": "application/json",
             "accept": "application/json",
-            authorization: `Bearer ${this.apiKey}`,
+            "x-api-key": this.apiKey,
           },
           body: payloadText,
           signal: controller.signal,
diff --git a/tests/trustsignalClient.test.ts b/tests/trustsignalClient.test.ts
index 31dd3bd..97a1d92 100644
--- a/tests/trustsignalClient.test.ts
+++ b/tests/trustsignalClient.test.ts
@@ -55,7 +55,7 @@ describe("TrustSignalVerificationClient", () => {
       expect.objectContaining({
         method: "POST",
         headers: expect.objectContaining({
-          authorization: "Bearer secret",
+          "x-api-key": "secret",
           "accept": "application/json",
         }),
       })
@@ -136,7 +136,7 @@ describe("TrustSignalVerificationClient", () => {
       expect.objectContaining({
         method: "POST",
         headers: expect.objectContaining({
-          authorization: "Bearer secret",
+          "x-api-key": "secret",
         }),
       })
     );
@@ -146,7 +146,7 @@ describe("TrustSignalVerificationClient", () => {
       expect.objectContaining({
         method: "POST",
         headers: expect.objectContaining({
-          authorization: "Bearer secret",
+          "x-api-key": "secret",
         }),
       })
     );