fix(provider): scope AI Gateway token to first-party Workers AI models#33597
Open
keefetang wants to merge 1 commit into
Open
fix(provider): scope AI Gateway token to first-party Workers AI models#33597keefetang wants to merge 1 commit into
keefetang wants to merge 1 commit into
Conversation
anomalyco#32052 fixed anomalyco#32051 (Workers AI 401s) by passing apiKey to createUnified, but applied it to every model — so the Cloudflare API token was sent as the upstream Authorization header for third-party providers (OpenAI, Anthropic), causing them to 401 with "Invalid API Key". Scope token forwarding to be model-aware: attach the Cloudflare token only for first-party Workers AI models, whose upstream is Cloudflare itself. The Unified API addresses Workers AI both as "workers-ai/..." and as bare "@cf/..." ids, so match both; "@cf/" is Cloudflare's reserved namespace, so this never matches a third-party model. Other providers receive no upstream Authorization and fall back to the gateway's stored/BYOK keys. Applied in both the v1 provider (provider.ts) and v2 plugin (core/.../cloudflare-ai-gateway.ts) paths. Tests assert both directions, including that third-party sub-requests carry no upstream authorization header. Reapplies and extends the approach from anomalyco#33407.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #32051
Reapplies and extends #33407 (auto-closed on a PR-template technicality).
Fixes the third-party regression introduced by #32052.
Type of change
What does this PR do?
#32052 fixed #32051 (Workers AI models 401'd through the gateway) by passing
apiKeytocreateUnified. That apiKey was applied to every model, so theCloudflare API token was sent as the upstream
Authorizationheader forthird-party providers (OpenAI, Anthropic) too — causing them to 401 with
"Invalid API Key".
This scopes token forwarding to be model-aware. The Cloudflare token is only
attached for first-party Workers AI models, whose upstream is Cloudflare
itself; everything else relies on the gateway's stored/BYOK credentials (or
Unified Billing):
Both Workers AI id forms the Unified API accepts are matched: the explicit
workers-ai/...prefix and the bare@cf/...form.@cf/is Cloudflare'sreserved namespace, so this never matches a third-party model.
Applied in both the v1 provider path (
provider.ts) and the v2 plugin path(
core/.../cloudflare-ai-gateway.ts). The gateway-level auth(
createAiGateway({ apiKey }), thecf-aig-authorizationheader) is unchanged.How did you verify your code works?
Added regression tests in
packages/opencode/test/provider/cf-ai-gateway-e2e.test.tsthat capture the real forwarded headers and assert both directions:
upstream sub-request carries no
authorizationheader (fix(provider): pass apiKey to createUnified for Cloudflare AI Gateway #32052 regression)workers-ai/...and bare@cf/...models do forward it (cloudflare-ai-gateway provider returns 401 for Workers AI models #32051)Screenshots / recordings
N/A — no UI changes.
Checklist