hyperswitch

d76c272c - fix(blocklist): restrict listing to server-side authentication

fix(blocklist): restrict listing to server-side authentication Require a merchant secret API key or a permission-checked JWT for GET /blocklist. Remove SDK authentication selection, the obsolete client_secret query field, and its ClientSecretFetch implementation. Update the OpenAPI authentication contract and shared query schemas. BREAKING CHANGE: Blocklist listing no longer accepts publishable-key/client-secret authentication. Use a merchant secret API key or a JWT with ProfileAccountRead permission. Constraint: Preserve existing API-key platform flags and JWT profile permissions Confidence: high Scope-risk: narrow