Skip to content

fix: use inline API key as BYOK fallback in AI Gateway#5614

Open
shouryamaanjain wants to merge 2 commits intoHelicone:mainfrom
shouryamaanjain:fix/ai-gateway-inline-api-key-5561
Open

fix: use inline API key as BYOK fallback in AI Gateway#5614
shouryamaanjain wants to merge 2 commits intoHelicone:mainfrom
shouryamaanjain:fix/ai-gateway-inline-api-key-5561

Conversation

@shouryamaanjain
Copy link

@shouryamaanjain shouryamaanjain commented Mar 1, 2026

Summary

  • When users provide their API key via the Authorization header but have no stored provider key in the database, the gateway now falls back to the inline key for BYOK routing instead of only attempting PTB (free-tier) keys.
  • This fixes the issue where providers like Gemini would ignore user-provided API keys and default to Helicone's own PTB keys.

Changes

  • AttemptBuilder.ts: Added inlineApiKey parameter threaded through buildAttemptsbuildAttemptsForAllProviders / getProviderAttemptsbuildByokAttempts. When no stored BYOK key exists, creates a virtual provider key from the inline API key.
  • SimpleAIGateway.ts: Extracts the user's API key from the request and passes it as inlineApiKey (only if it's not a Helicone auth key).

Test plan

  • Existing BYOK/PTB priority tests pass (9/9)
  • Pass-through, provider-ignore, and PTB validation tests pass (28/28)
  • Manual test: send a Gemini request with API key in Authorization header, verify it uses the provided key

Closes #5561

…into env.js

The supervisord environment directive was re-declaring env vars like
NEXT_PUBLIC_HELICONE_JAWN_SERVICE and BETTER_AUTH_SECRET using %(ENV_...)s
interpolation. This could override docker-compose values with Dockerfile
defaults, preventing user-configured URLs from reaching the frontend.

Fix:
- Remove %(ENV_...)s re-declarations from supervisord.conf for both
  web and jawn programs — these vars are already set in the Dockerfile
  and are automatically inherited by child processes
- Add docker-entrypoint.sh that generates __ENV.js from the container's
  actual NEXT_PUBLIC_* env vars before supervisord starts

Closes Helicone#5551
When users provide their API key via the Authorization header but have no
stored provider key in the database, the gateway now falls back to the
inline key for BYOK routing instead of only using PTB (free-tier) keys.

Closes Helicone#5561
@vercel
Copy link

vercel bot commented Mar 1, 2026

@shouryamaanjain is attempting to deploy a commit to the Helicone Team on Vercel.

A member of the Team first needs to authorize it.

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: AI Gateway (ai-gateway.helicone.ai) ignores provided Gemini API key, uses free-tier keys instead

1 participant