[BUG] 401 Unauthorized with new Sonatype Guide token

[davidmoravek]

Describe the bug
oysteR does not seem to work with a new Sonatype Guide account/token.

The package historically targets OSS Index and uses the legacy OSS Index endpoint internally. I patched the request host to https://api.guide.sonatype.com/api/v3/component-report, but the request still returns:

401 Unauthorized
Invalid credentials for OSS Index

To Reproduce
Steps to reproduce the behavior:

1. Configure credentials in ~/.ossindex/.oss-index-config
2. Run:

oysteR::audit(
  pkg = "dplyr",
  version = as.character(utils::packageVersion("dplyr")),
  type = "cran",
  token = list(user = "<email>", token = "<token>")
)

See error:
401 Unauthorized
Invalid credentials for OSS Index

Expected behavior
I expected oysteR to work with the new Sonatype Guide host and token, or at least provide a clearer error about credential/backend incompatibility.

Desktop:
OS: Linux 6.8.0-1030-azure
R Version: R version 4.5.2 (2025-10-31)
oysteR Version: 0.1.4

I additionally verified that:

YAML/config loading works
explicit token passing works
the request host can be switched from ossindex.sonatype.org to api.guide.sonatype.com
the request still fails with 401

From the Sonatype Guide API catalog, it looks like Guide native API uses Bearer authentication, while OSS Index Compatibility is separate and expects HTTP Basic Auth with OSSI username + OSSI API token for existing OSSI users.

I am opening this here because the README states that oysteR is a community project and not officially supported by Sonatype.

[davidmoravek]

I also noticed open PR #73 ("feat: Add support for custom OSS Index URL"), which looks relevant because it would remove the need to patch the host manually.

However, in my case the problem seems to go beyond the hostname alone:
even after switching the request host to https://api.guide.sonatype.com/api/v3/component-report, authentication still fails with 401.

From the Sonatype Guide API catalog, it looks like Guide native API uses Bearer auth, while OSS Index Compatibility is separate and expects HTTP Basic Auth with OSSI username + OSSI API token for existing OSSI users.