[John-David Dalton (jdalton)]

Reject the retired shared API credential before the Python SDK stores or encodes it. The error tells users to configure a replacement; valid credentials keep their existing selection order and encoded bytes.

Implementation and validation

Checks SDK construction and Basic-auth username encoding, including explicit arguments and all four environment sources. Compares a SHA-256 fingerprint; source and errors contain no credential value.

Validation: 12 focused tests passed. New helper and test files passed Ruff. Tests use synthetic credentials and make no Socket API calls.

Links and PR checklist

Reject a retired shared API credential with instructions to configure a replacement.

Automated review notes

---

[!NOTE]
Medium Risk
Changes credential validation on every client init and encode_key path; misconfigured digest or matching logic could block legitimate tokens or miss the retired one.

Overview
Blocks a retired shared API credential before the Python SDK stores or Base64-encodes it, with a fixed user-facing error telling customers to create a new token.

Token resolution moves into select_token, keeping the same behavior: explicit token wins (including empty string), otherwise the first set of the four SOCKET_* env vars. After resolution, reject_retired_token compares a trimmed SHA-256 digest to a baked-in fingerprint (no raw secret in repo or errors). API.encode_key also runs reject_retired_basic_auth_token, checking only the Basic-auth username segment before the first :.

Unit tests cover rejection messaging/redaction, env precedence, whitespace trimming, and non-retired tokens without network calls.

^{Reviewed by Cursor Bugbot for commit 6ebd180. Configure here.}