[Mohammad Malik (mohammad-malik)]

Fixes #12354

With @useAuth(BearerAuth | NoAuth), the JS client emitter generated a required credential parameter, so there was no way to call the service anonymously. The Python emitter already handles this (#9298).

Changes:

• http-client-js (utils/parameters.tsx): the credential is optional when NoAuth is an alternative for every operation of the client. An optional credential stays positional, after the required parameters and before options. A parent client that requires auth still gets a required credential even if a nested namespace uses NoAuth (covered by the existing sub_client_override.md).
• http-client (utils/client-helpers.ts): the synthetic credential parameter was cached by scheme type only, so BearerAuth and BasicAuth could share one cache entry and produce the wrong credential type depending on test order. The cache key now includes the http scheme. I updated bearer.md and client_structure.md, which had been expecting BasicCredential for BearerAuth.
• New scenario test/scenarios/auth/no_auth_union.md.
• Chronus change entries for both packages.

No runtime change is needed: with credential: undefined, getClient from @typespec/ts-http-runtime adds no auth policy and sends no Authorization header.

Tests pass in http-client-js (248 passed) and http-client (46 passed), and lint and prettier are clean.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The credential remains incorrectly required when every operation permits anonymous access because the check uses the namespace authentication default instead of effective per-operation requirements.

1 open issue

• Honor operation-level anonymous authentication overrides · New

What changed in this PR

Updates the JavaScript HTTP client emitter to support anonymous calls when authentication allows NoAuth, addressing #12354. It also fixes credential-type reuse in the shared HTTP client helpers.

Changes:

• Makes eligible credentials optional while keeping them positional before options.
• Distinguishes HTTP authentication schemes in the credential cache.
• Adds an anonymous-auth scenario, corrects bearer expectations, and records both fixes in changelogs.

File	Description
packages/​http-client/​src/​utils/​client-helpers.ts	Includes HTTP scheme names in credential cache keys.
packages/​http-client-js/​test/​scenarios/​auth/​no_auth_union.md	Adds optional-credential constructor and context expectations.
packages/​http-client-js/​test/​scenarios/​auth/​client_structure.md	Corrects the expected credential type to bearer.
packages/​http-client-js/​test/​scenarios/​auth/​bearer.md	Corrects bearer constructor and context expectations.
packages/​http-client-js/​src/​utils/​parameters.tsx	Determines credential optionality and preserves positional ordering.
.chronus/​changes/​http-client-js-noauth-optional-credential-2026-10-13-23-40-0.md	Documents optional credentials for anonymous access.
.chronus/​changes/​http-client-fix-credential-cache-key-2026-10-13-23-45-0.md	Documents the credential cache correction.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The credential name check incorrectly moves ordinary optional server URL parameters out of the options bag, breaking existing constructor calls and conflicting with the endpoint’s options-based lookup.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Restrict credential constructor handling to credential properties

packages/​http-client-js/​src/​utils/​parameters.tsx:32

The name check also matches an ordinary optional @server URL parameter such as { credential?: string = "anonymous" } on a service without authentication, changing its constructor from (options?) to (credential?: string, options?) and breaking previously valid calls such as new TestClient({}). Restrict this exception to properties identified by $.modelProperty.isCredential; ordinary URL parameters must remain in the options bag because client-context/parametrized-endpoint.tsx:25-27 still reads them from options.

1 resolved since last review

• Honor operation-level anonymous authentication overrides

_{Review effort: Balanced}