Configured credentialless providers require an empty API key #42790

Activity

1. kvnloo commented on Sep 15, 2026

   

   kvnloo

   on Sep 15, 2026

   More actions

   Re-checked on current dev (e03db9b).

   Still broken:

   1. Catalog.provider.available treats any string request.body.apiKey as an enablement signal, including "". An integration-backed provider with custom baseURL/headers and no credential stays unavailable unless you set apiKey: "".
   2. That empty string then goes through SessionRunnerModel’s apiKey() as Auth.value(""), which fails with missing credential instead of Auth.none (omitting the key is fine).

   Live: unit repro on this HEAD — (a) no apiKey → absent from provider.available(), (b) apiKey: "" → present, (c) empty key auth apply → Failure, (d) omitted key → Auth.none.

   Prior #44418 never landed and targeted the old aisdk-native mapper. On this tree the leaf is:

   • packages/core/src/catalog.ts (typeof … === "string")
   • packages/core/src/session/runner/model.ts (apiKey() empty → Auth.value)

   Happy to send a tiny issue-linked fix treating "" as unset in both places if that’s wanted.
2. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   More actions

   Thanks for the report. I couldn't reproduce this on v2.2.0, the latest release, since the issue doesn't give a version number.

   What I tried:

   • No provider API key, no env vars and no Integration connection.
   • A config entry for xai and one for google, each with only settings.baseURL and a custom header (no apiKey).

   What happened:

   • opencode models listed both providers without apiKey: "". Without the config entry, neither was listed.
   • opencode run sent requests without credentials, so native auth was skipped without an empty key.

   The current dev code (ced73dc0f) already models this the way you describe:

   • Configured providers get activation: "enabled".
   • auto providers derive availability from Integration state.
   • disabled providers stay unavailable.
   • ModelResolver falls back to Auth.none only for enabled API-key packages that have no resolved or configured credential, so provider-owned auth like Bedrock SigV4 is left alone.

   If you still see the provider missing, the exact commit or version and the config you used would help.

   Separately, my requests went to the real xAI/Google endpoints, not the mock server at the configured baseURL. I didn't check whether that's a bug or a mistake in my config.
3. Tarquinen commented on Nov 2, 2026

   

   Tarquinen

   on Nov 2, 2026

   Member

   More actions

   This was fixed by #60770: providers that don't need credentials can now set apiKey: false. It will ship in the next release. Closing this issue.

   — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊
4. Tarquinen

   closed this as completedon Nov 2, 2026