fix(python): treat empty-string credentials as unset so the environment fallback applies

A security value passed as an empty string (for example
`SDK(api_key_auth="")`) was treated as provided: `get_security_from_env`
returned early, so the `envVarPrefix` fallback never ran, and
`get_security` serialized the empty value, producing headers such as
`Authorization: Bearer ` that httpx rejects as an illegal header value.

Empty-string credentials are now skipped when building request
security, so a later non-empty scheme can be selected, and a global
security object whose credentials are all empty falls back to the
environment. Basic and custom schemes keep their existing behaviour,
so an explicitly empty username or password is still sent.

Author: LukasParke

.changesets/1792609133-aea59846.yaml

@@ -0,0 +1,10 @@
+id: 1792609133-aea59846
+features:
+    - globalSecurity
+targets:
+    - pythonv2
+type: fix
+bump: patch
+description: treat empty-string credentials as unset so the environment variable fallback applies and no empty credential header or query parameter is sent
+author: LukasParke
+date: "2026-10-21"

templates/templates/pythonv2/auxiliary/{{getSourcePath}}/utils/security.py.stmpl

@@ -46,6 +46,8 @@ def get_security(security: Any, allowed_fields: Optional[List[str]] = None) -> T
         metadata = find_field_metadata(sec_field, SecurityMetadata)
         if metadata is None:
             continue
+        if value == "" and metadata.sub_type not in ["basic", "custom"]:
+            continue
         if metadata.option:
             _parse_security_option(headers, query_params, value)
             return headers, query_params
@@ -63,7 +65,7 @@ def get_security(security: Any, allowed_fields: Optional[List[str]] = None) -> T
 {{ if (and .Global.Config.EnvVarPrefix .Global.AST.MainSDK.Security) }}
 
 def get_security_from_env(security: Any, security_class: Any) -> Optional[BaseModel]:
-    if security is not None:
+    if security is not None and not (isinstance(security, security_class) and _is_unset(security)):
         return security
 
     if not issubclass(security_class, BaseModel):
@@ -90,7 +92,26 @@ def get_security_from_env(security: Any, security_class: Any) -> Optional[BaseMo
         security_dict["{{ sanitizeFieldName $option.Name }}"] = {{templateSecurityEnvVarValue $option}}
   {{ end -}}{{/* end if $option is a class */}}
 {{ end }}{{/* end range $option */}}
-    return security_class(**security_dict) if security_dict else None
+    return security_class(**security_dict) if security_dict else security
+
+
+def _is_unset(security: BaseModel) -> bool:
+    for name, field in security.__class__.model_fields.items():
+        value = getattr(security, name)
+        if value is None:
+            continue
+
+        metadata = find_field_metadata(field, SecurityMetadata)
+        if metadata is None:
+            continue
+        if metadata.option and isinstance(value, BaseModel) and _is_unset(value):
+            continue
+        if value == "" and metadata.sub_type not in ["basic", "custom"]:
+            continue
+
+        return False
+
+    return True
 {{ end }}{{/* end if EnvVarPrefix and global security set */}}
 
 def _parse_security_option(
@@ -166,6 +187,9 @@ def _parse_security_scheme_value(
     scheme_type = scheme_metadata.scheme_type
     sub_type = scheme_metadata.sub_type
 
+    if value == "":
+        return
+
     header_name = security_metadata.get_field_name(field_name)
 
     if scheme_type == "apiKey":

templates/templates/pythonv2/tests/primary/test_auth_additional.py

@@ -40,6 +40,22 @@ def test_global_security_fields_ordering():
     assert exc_info.value.status_code == 401
 
 
+def test_global_security_fields_ordering_skips_empty_strings():
+    record_test("auth-global-security-fields-ordering")
+
+    s = SDK(
+        server_url=HTTPBIN_URL,
+        security=shared.Security(access_token="", api_key_auth="", oauth2="global"),
+    )
+
+    res = s.auth.global_bearer_auth()
+    assert res.http_meta is not None
+    assert res.http_meta.response is not None
+    assert res.http_meta.response.status_code == 200
+    assert res.token is not None
+    assert res.token.token == "global"
+
+
 def test_hoisted_security_access_token_only():
     record_test("auth-hoisted-security-access-token-only")
 

templates/templates/pythonv2/tests/quaternary/test_auth_additional.py

@@ -1,5 +1,7 @@
 import os
+import httpx
 from openapi import SDK, AsyncSDK
+from openapi.models.errors import SDKError
 from .common_helpers import *
 import pytest
 
@@ -59,3 +61,34 @@ async def test_global_security_flattening_env_var_fallback_async():
             assert res.status_code == 200
     finally:
         os.environ.pop("SPEAKEASY_API_KEY_AUTH", None)
+
+
+def test_global_security_flattening_empty_string_env_var_fallback():
+    record_test("auth-global-security-flattening-env-var-fallback")
+
+    os.environ["SPEAKEASY_API_KEY_AUTH"] = "Bearer testToken"
+    try:
+        with SDK(api_key_auth="") as s:
+            res = s.auth.api_key_auth_global()
+            assert res is not None
+            assert res.status_code == 200
+    finally:
+        os.environ.pop("SPEAKEASY_API_KEY_AUTH", None)
+
+
+def test_global_security_flattening_empty_string_without_env_var():
+    record_test("auth-global-security-flattening-env-var-fallback")
+
+    os.environ.pop("SPEAKEASY_API_KEY_AUTH", None)
+    captured = {}
+
+    def capture(request):
+        captured["headers"] = request.headers
+        return httpx.Response(401, request=request)
+
+    client = httpx.Client(transport=httpx.MockTransport(capture))
+    with SDK(server_url=HTTPBIN_URL, api_key_auth="", client=client) as s:
+        with pytest.raises(SDKError):
+            s.auth.api_key_auth_global()
+
+    assert "authorization" not in captured["headers"]

zSDKs/sdk-pythonv2/.speakeasy/gen.lock

@@ -49,6 +49,8 @@ def get_security(
         metadata = find_field_metadata(sec_field, SecurityMetadata)
         if metadata is None:
             continue
+        if value == "" and metadata.sub_type not in ["basic", "custom"]:
+            continue
         if metadata.option:
             _parse_security_option(headers, query_params, value)
             return headers, query_params
@@ -68,7 +70,9 @@ def get_security(
 
 
 def get_security_from_env(security: Any, security_class: Any) -> Optional[BaseModel]:
-    if security is not None:
+    if security is not None and not (
+        isinstance(security, security_class) and _is_unset(security)
+    ):
         return security
 
     if not issubclass(security_class, BaseModel):
@@ -136,7 +140,26 @@ def get_security_from_env(security: Any, security_class: Any) -> Optional[BaseMo
             "SPEAKEASY_MY_API_KEY"
         )
 
-    return security_class(**security_dict) if security_dict else None
+    return security_class(**security_dict) if security_dict else security
+
+
+def _is_unset(security: BaseModel) -> bool:
+    for name, field in security.__class__.model_fields.items():
+        value = getattr(security, name)
+        if value is None:
+            continue
+
+        metadata = find_field_metadata(field, SecurityMetadata)
+        if metadata is None:
+            continue
+        if metadata.option and isinstance(value, BaseModel) and _is_unset(value):
+            continue
+        if value == "" and metadata.sub_type not in ["basic", "custom"]:
+            continue
+
+        return False
+
+    return True
 
 
 def _parse_security_option(
@@ -214,6 +237,9 @@ def _parse_security_scheme_value(
     scheme_type = scheme_metadata.scheme_type
     sub_type = scheme_metadata.sub_type
 
+    if value == "":
+        return
+
     header_name = security_metadata.get_field_name(field_name)
 
     if scheme_type == "apiKey":