fix(speech-engine): strip residency suffix from API key before JWT verification

[PaulAsjes]

Summary

Speech Engine servers configured with a data-residency API key (for example sk_..._residency_in) rejected every upstream connection with "Invalid JWT: signature mismatch". The API signs the handshake JWT with a hash of the base key, with the _residency_<region> suffix removed, but the SDK hashed the key exactly as given. The SDK now strips the suffix the same way before hashing, so residency keys work without the workaround of passing a hand-trimmed key to the server.

Details

• Reported in Zendesk ticket 747740 for an IN residency workspace; the same failure applies to EU and SG keys.
• The suffix is matched generically as _residency_[a-z0-9]+$ rather than an enumerated region list, so a new region does not need an SDK release. The backend issues the keys, so an unknown suffix should not occur in practice.
• Only the hashing step changes. Bearer-prefix handling, issuer, subject, and expiry checks are untouched.
• Same fix as fix(speech-engine): strip residency suffix from API key before JWT verification #872, applied to the v3 next branch so the next major release includes it. JS counterpart: fix(speech-engine): strip residency suffix from API key before JWT verification elevenlabs-js#458.

Testing

• pytest tests/test_speech_engine_auth.py: 24 passed, including two new cases (residency key verifies against a token signed with the base key; residency key with the wrong base key is still rejected).
• mypy clean on the changed file. Ruff reports one pre-existing import-sort warning on the file, present on the base branch too.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches Speech Engine JWT HMAC verification, but the change is limited to key normalization so residency keys align with API signing; wrong keys remain rejected in tests.

Overview
Fixes Speech Engine upstream auth when the server is configured with a data-residency API key (e.g. sk_..._residency_in), which previously failed JWT verification with a signature mismatch.

verify_speech_engine_jwt now normalizes the configured key via _normalize_api_key_for_signing: trim whitespace and remove a trailing _residency_<region> suffix (regex _residency_[a-z0-9]+$) before SHA-256 hashing, matching how the API signs handshake JWTs with the base key. Issuer, subject, expiry, and Bearer handling are unchanged.

Tests add acceptance for a residency-configured key against a token signed with the base key, and rejection when the base key does not match.

^{Reviewed by Cursor Bugbot for commit 7a9be94. Bugbot is set up for automated code reviews on this repo. Configure here.}