fix: use create-first API credential fallback

Author: cesarenaldi

packages/client/src/actions/auth.ts

@@ -101,7 +101,7 @@ export type CreateOrDeriveApiKeyError =
   | UnexpectedResponseError;
 
 /**
- * Derives an API key and falls back to creation when one does not exist yet.
+ * Creates an API key and falls back to derivation when it already exists.
  *
  * @remarks
  * This is a low-level auth action that most SDK consumers will not need.
@@ -118,14 +118,6 @@ export async function createOrDeriveApiKey(
   client: Client,
   request: L2AuthRequest,
 ): Promise<ApiKeyCreds> {
-  try {
-    return await deriveApiKey(client, request);
-  } catch (error) {
-    if (!(error instanceof RequestRejectedError) || error.status !== 400) {
-      throw error;
-    }
-  }
-
   try {
     return await createApiKey(client, request);
   } catch (error) {

packages/client/src/clients.test.ts

@@ -23,6 +23,20 @@ describe('clients', () => {
       await expect(fetchApiKeys(secureClient)).resolves.toBeDefined();
     });
 
+    it('authenticates twice with the same nonce', async () => {
+      const firstClient = await publicClient
+        .beginAuthentication({ nonce: 2 })
+        .then(authenticateWith(walletClient));
+
+      await expect(fetchApiKeys(firstClient)).resolves.toBeDefined();
+
+      const secondClient = await publicClient
+        .beginAuthentication({ nonce: 2 })
+        .then(authenticateWith(walletClient));
+
+      await expect(fetchApiKeys(secondClient)).resolves.toBeDefined();
+    });
+
     it('reuses stored credentials during authentication when they remain valid', async () => {
       const initialClient = await publicClient
         .beginAuthentication()