in v17.4 extensions the auth is done with a hey-api.ts file in the root of source , (and config in the tsconfig to tell hey-api that is where it is.

ts
/**
 * Pre-configure the generated client by copying the Umbraco HTTP client's config.
 *
 * Called automatically by the generated client during initialization (via runtimeConfigPath).
 * Inherits baseUrl, credentials, auth, and headers from umbHttpClient — which is already
 * configured by the backoffice before extensions load.
 *
 * @see https://heyapi.dev/openapi-ts/clients/fetch#configuration
 */
export const createClientConfig: CreateClientConfig = (config) => ({
    ...config,
    ...umbHttpClient.getConfig(),
});

in the v18-rc3 extension template this is back to auth in the

UmbEntryPointOnInit

ts
// load up the manifests here
export const onInit: UmbEntryPointOnInit = async (host, _extensionRegistry) => {
  // Wire the generated API client into the backoffice auth context.
  // configureClient() sets baseUrl + credentials, attaches the auth callback
  // (cookie-based, with automatic token refresh) and binds the default
  // response interceptors (401 retry, error notifications, etc.).
  // The framework awaits onInit, so resolving the context here ensures the
  // client is fully configured before any element in this extension can use it.
  const authContext = await host.getContext(UMB_AUTH_CONTEXT);
  if (!authContext) {
    console.warn("UMB_AUTH_CONTEXT not available — extension API client will not be authenticated");
    return;
  }
  authContext.configureClient(client);

  console.log("Hello from my extension 🎉");
};

is this a revert in the recommended way to do it. or are the templates out of date ?

The entrypoint is the way to go. Turns out that the 17.4 version didn't add interceptors to the third-party clients. 17.5 is aligned with 18.0 and they go out the same day this week.

Has HeyAPI settled as each version seems to keep chaning & moving stuff about ?!

Yes, more or less. They switched to an options based pattern a couple of years ago and since then, they have been deprecating and introducing new things in a timely manner. They are still in 0.x version range meaning each "minor" could be a breaking version.