Skip to content

docs: a blank key on a custom base URL is sent as an empty key - #266

Merged
eric8810 merged 1 commit into
masterfrom
docs/blank-key-on-a-custom-base-url-is-sent-as-an-empty-key
Oct 16, 2026
Merged

eric8810 merged 1 commit into
masterfrom
docs/blank-key-on-a-custom-base-url-is-sent-as-an-empty-key

Conversation

@cunninghamcard-bit

Copy link
Copy Markdown
Contributor

Requested by li

Summary

Before: the web console README and RFC-0029 say that a call to a custom base_url with no key "goes out without a key".

After: both say what the code does. The key is sent as an explicit empty key, the same as the AI SDK with apiKey: ''. No stored or environment key is used, and OpenAI and similar providers send an empty credential header such as Authorization: Bearer .

This is the wording fix from the #248 review (point 1). The code is unchanged: wire.rs returns Some("") for a custom base URL with a blank key, and @ai-sdk/openai 4.0.83 sends Bearer ${loadApiKey(...)} the same way.

Type of change

  • Bug fix (non-breaking)
  • New feature (non-breaking)
  • Breaking change
  • New provider
  • New / updated binding
  • Docs / RFC

Checklist

  • cargo fmt --all -- --check passes
  • cargo clippy --workspace --all-targets -- -D warnings passes
  • cargo test --workspace passes (cassette playback — no network/keys)
  • Added or updated cassette tests / contract fixtures for behavior changes
  • Updated relevant docs (README.md, docs/, rfc/, bindings/README.md)
  • Commit messages follow Conventional Commits

Notes for reviewers

  • Docs only: tools/aimux-web/README.md and rfc/0029-web-console.md, three lines.
  • [5/8] ([5/8] refactor!: providers are AI SDK factories #253) rewrites the same paragraph. Once this merges, the next master merge into the series keeps the series' text, which carries the same correction.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A3WxDBWBA4ituJjXsHaEAa


Generated by Claude Code

The web console README and RFC-0029 said that a call to a custom
base_url with no key "goes out without a key". The code sends an
explicit empty key instead, as the AI SDK does for `apiKey: ''`: no
stored or environment key is used, and OpenAI and similar providers
send an empty credential header such as `Authorization: Bearer `.
The security property is unchanged; only the wording was wrong.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A3WxDBWBA4ituJjXsHaEAa

@eric8810 eric8810 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM —— 这正是 #248 评审第 1 点要求的措辞修正:空 key 实际以 Some("") 发出(RFC-0040 §3.1 的显式空值语义),OpenAI 族发空 Authorization: Bearer ,与上游 apiKey: '' 行为一致,不回落 Settings/env。两处文档(RFC-0029 §5.5、web README)措辞与代码事实对齐,仅 3 行,批准。

@eric8810
eric8810 merged commit cdfa287 into master Oct 16, 2026
19 checks passed
cunninghamcard-bit pushed a commit that referenced this pull request Oct 16, 2026
Brings in #266 (a blank key on a custom base URL is sent as an empty
key, as the AI SDK does for apiKey: '').

Resolution: no conflicts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A3WxDBWBA4ituJjXsHaEAa
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants