fix: send auth header as api-access-token

[scmmishra]

Closes #41

Problem

The CLI sent its token as api_access_token. Reverse proxies that drop headers containing underscores — Caddy 2.6.4+ by default, nginx with the default underscores_in_headers off — strip it, so every call to a self-hosted instance behind them fails with 401.

Fix

Send api-access-token instead. Server side this is equivalent:

• Chatwoot reads request.headers[:HTTP_API_ACCESS_TOKEN] (access_token_auth_helper.rb).
• Per the CGI/Rack mapping (RFC 3875 §4.1.18), api-access-token → HTTP_API_ACCESS_TOKEN.
• Puma maps the underscore form to the same key, and since CVE-2024-45614 prefers the hyphen form when both exist.

No server change needed; direct-to-Rails setups are unaffected.

Changes

• internal/sdk/client.go: header name in request and rawRequest
• Tests assert the new header name
• internal/sdk/CLAUDE.md and CHANGELOG.md updated

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T09:35:08.000872Z	479f61e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/chatwoot/cli/internal/cmd	48.50% (ø)
github.com/chatwoot/cli/internal/sdk	56.25% (ø)

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/chatwoot/cli/internal/sdk/client.go	60.47% (ø)	129	78	51

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/chatwoot/cli/internal/cmd/api_test.go
• github.com/chatwoot/cli/internal/sdk/contract_test.go
• github.com/chatwoot/cli/internal/sdk/help_center_test.go

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 479f61e702

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor underscore-form token overrides in raw API calls

When an account-scoped raw call supplies Chatwoot's documented -H 'api_access_token: ...' header, RequestRaw deletes only that underscore-form key (internal/sdk/client.go:254-258), not the new Api-Access-Token, because Go treats the two names as distinct. Both values are therefore sent, and Rack/Puma's collision handling can prefer the configured hyphenated token instead of the caller's override. This regresses the previous override behavior for the spelling still advertised by the pinned Swagger; normalize this alias or delete both forms before applying custom headers.

Useful? React with 👍 / 👎.