BufferedConsumer._flush_endpoint() doesn't pass api_secret parameter causing authentication failures for merge operations

[benjy44]

Version: 4.11.1 (latest)

Description: The BufferedConsumer._flush_endpoint() method has a bug where it doesn't properly pass the api_secret parameter when calling the underlying Consumer.send() method. This causes authentication failures for operations that require HTTP Basic Auth with the API secret, such as the merge() method.

Root Cause: In BufferedConsumer._flush_endpoint() (around line 540), the code calls:

self._consumer.send(endpoint, batch_json, api_key=self._api_key)

However, self._api_key is actually a tuple (api_key, api_secret) set in the send() method:

if not isinstance(api_key, tuple):
    api_key = (api_key, api_secret)
# ...
self._api_key = api_key

The underlying Consumer.send() expects separate api_key and api_secret parameters, and Consumer._write_request() correctly handles tuple unpacking:

if isinstance(api_key, tuple):
    api_key, api_secret = api_key

But BufferedConsumer._flush_endpoint() doesn't pass the api_secret parameter at all.

Expected Behavior: Merge operations should work with BufferedConsumer

Actual Behavior: Merge operations fail with "Access is forbidden due to request missing authentication details"

Error Message:

Mixpanel error: Access is forbidden due to request missing authentication details. Please see: https://developer.mixpanel.com/reference/ingestion-api-authentication

Code to Reproduce:

from mixpanel import Mixpanel, BufferedConsumer

consumer = BufferedConsumer()
mp = Mixpanel("project_token", consumer=consumer)

# This fails with authentication error
mp.merge(
    api_key="project_token",
    api_secret="api_secret",
    distinct_id1="id1",
    distinct_id2="id2"
)
consumer.flush()

Workaround: Use regular Consumer instead of BufferedConsumer for merge operations:

from mixpanel import Mixpanel, Consumer

consumer = Consumer()  # Use regular Consumer
mp = Mixpanel("project_token", consumer=consumer)

# This works correctly
mp.merge(
    api_key="project_token",
    api_secret="api_secret",
    distinct_id1="id1",
    distinct_id2="id2"
)

Environment:

• Python version: 3.12
• mixpanel-python version: 4.11.1

This affects any operation that requires API secret authentication when using BufferedConsumer.