Enforce mutually exclusive api_key and limited_access_key inputs in NucleusClient and fix all remaining Sphinx doc build warnings (#457)

* Make different auth keys mutually exclusive

* Fix mypy errors

* Re-add UploadResponse export from init file

* Undo removal of unused imports

Author: edwinpav

CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to the [Nucleus Python Client](https://github.com/scaleapi/n
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.17.14](https://github.com/scaleapi/nucleus-python-client/releases/tag/v0.17.14) - 2026-04-14
+
+### Changed
+- `api_key` and `limited_access_key` are now mutually exclusive in `NucleusClient`. Passing both (or setting `NUCLEUS_API_KEY` while also passing `limited_access_key`) raises a `ValueError`.
+
+### Fixed
+- Docstring improvements across `NucleusClient`: fixed copy-paste errors (`get_job`, `get_slice`, `delete_slice`), removed phantom `stats_only` parameter from `list_jobs`, corrected `make_request` parameter name, and restructured `create_launch_model`/`create_launch_model_from_dir` docs for proper rendering.
+- Suppressed Sphinx warnings from inherited pydantic `BaseModel` methods by removing `inherited-members` from autoapi options.
+
 ## [0.17.13](https://github.com/scaleapi/nucleus-python-client/releases/tag/v0.17.13) - 2026-03-06
 
 ### Fixed

cli/client.py

@@ -13,6 +13,11 @@ def init_client():
 
         api_key = os.environ.get("NUCLEUS_API_KEY", None)
         limited_access_key = os.environ.get("NUCLEUS_LIMITED_ACCESS_KEY", None)
+        if api_key and limited_access_key:
+            raise RuntimeError(
+                "Both NUCLEUS_API_KEY and NUCLEUS_LIMITED_ACCESS_KEY are set. "
+                "Please set only one."
+            )
         if api_key or limited_access_key:
             client = nucleus.NucleusClient(api_key=api_key, limited_access_key=limited_access_key)
         else:

conftest.py

@@ -23,7 +23,9 @@
 @pytest.fixture(scope="session")
 def CLIENT():
     if API_KEY and LIMITED_ACCESS_KEY:
-        return nucleus.NucleusClient(api_key=API_KEY, limited_access_key=LIMITED_ACCESS_KEY)
+        raise RuntimeError(
+            "Set only one of NUCLEUS_PYTEST_API_KEY or NUCLEUS_PYTEST_LIMITED_ACCESS_KEY, not both."
+        )
     if API_KEY:
         return nucleus.NucleusClient(api_key=API_KEY)
     # LIMITED_ACCESS_KEY only

docs/conf.py

@@ -48,6 +48,7 @@
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path.
 exclude_patterns = []
+suppress_warnings = ["toc.not_included"]
 
 
 # -- Options for HTML output -------------------------------------------------
@@ -75,7 +76,6 @@
 autoapi_options = [
     "members",
     "no-undoc-members",
-    "inherited-members",
     "show-module-summary",
     "imported-members",
 ]

nucleus/__init__.py

@@ -17,6 +17,12 @@ def __init__(self, api_key: Optional[str] = None, endpoint: Optional[str] = None
         self.api_key = api_key
         self.endpoint = endpoint
         self.extra_headers = extra_headers or {}
+        if self.api_key is not None and self.extra_headers.get(
+            "x-limited-access-key"
+        ):
+            raise ValueError(
+                "Cannot use both api key and limited access key simultaneously."
+            )
         # Require at least one auth mechanism: Basic (api_key) or limited access header
         if self.api_key is None and not self.extra_headers.get("x-limited-access-key"):
             raise NoAPIKey()

nucleus/connection.py

@@ -25,7 +25,7 @@ ignore = ["E501", "E741", "E731", "F401"]  # Easy ignore for getting it running
 
 [tool.poetry]
 name = "scale-nucleus"
-version = "0.17.13"
+version = "0.17.14"
 description = "The official Python client library for Nucleus, the Data Platform for AI"
 license =  "MIT"
 authors = ["Scale AI Nucleus Team <nucleusapi@scaleapi.com>"]

pyproject.toml

@@ -85,6 +85,10 @@ def client():
         raise RuntimeError(
             "Set at least one of api_key or limited_access_key (via flags or env)."
         )
+    if FLAGS.api_key and FLAGS.limited_access_key:
+        raise RuntimeError(
+            "Set only one of api_key or limited_access_key (via flags or env), not both."
+        )
     return nucleus.NucleusClient(
         api_key=FLAGS.api_key, limited_access_key=FLAGS.limited_access_key
     )