-
[OPIK-7267] [BE] fix: normalize Bearer-prefixed API key in remote auth
frostbyte_neo 发布于
2026-07-09 13:01:01 +00:00 Optimization Studio routes its LLM calls through the backend gateway
(/v1/private/chat/completions) via LiteLLM, whose OpenAI-compatible client
sends the Opik API key as "Authorization: Bearer ". RemoteAuthService
forwarded that header verbatim to the react-service, which does a literal
key lookup, so single-tenant deployments rejected every run with 401
"User with provided api key not found!" while the same key worked for the
SDK's REST calls (which send it raw).Strip a leading "Bearer " prefix before the cache lookup and before
forwarding to the react-service. A real Opik API key never starts with
"Bearer ", so the normalization is safe; it also makes any OpenAI-compatible
client hitting the gateway behave consistently across deployments.Adds a RemoteAuthService test that models the strict single-tenant
react-service (raw key resolves to a user, Bearer-prefixed is rejected).Resolves OPIK-7267
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
下载附件