From 5fbbec4902a61d4cc75868f9c7041aaaede536b5 Mon Sep 17 00:00:00 2001
From: Florian <florian@nocleus.com>
Date: Tue, 26 May 2026 00:32:33 +0200
Subject: [PATCH] =?UTF-8?q?fix(mf):=20utiliser=20header=20apikey:=20au=20l?=
 =?UTF-8?q?ieu=20de=20Bearer=20(API=20Key=20longue=20dur=C3=A9e)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le portail-api.meteofrance.fr utilise 2 mécanismes d auth différents :
- Token OAuth2 court (1h) → header Authorization: Bearer <token>
- API Key longue durée    → header apikey: <key>

On utilise la 2e, donc switch du header.

+ data-sources/Bulletin_Vigilance_swagger.json (gitignored mais utile en local
  pour préparer le switch Opendatasoft → Vigilance officielle Météo France).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/lib/meteofrance-auth.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/lib/meteofrance-auth.ts b/src/lib/meteofrance-auth.ts
index 49d44d4..d520866 100644
--- a/src/lib/meteofrance-auth.ts
+++ b/src/lib/meteofrance-auth.ts
@@ -17,11 +17,13 @@ export async function fetchMF(path: string, init: RequestInit = {}): Promise<Res
   if (!key) {
     throw new Error('METEOFRANCE_API_KEY missing in env');
   }
+  // Le portail Météo France utilise le header `apikey:` pour les API Keys
+  // longue durée (différent du `Authorization: Bearer` des tokens OAuth2 courts).
   return fetch(`${BASE}${path}`, {
     ...init,
     headers: {
       ...init.headers,
-      Authorization: `Bearer ${key}`,
+      apikey: key,
       Accept: 'application/json',
     },
   });