fix(client): restore api_key="" support for local OAI-compatible servers - #3630
fix(client): restore api_key="" support for local OAI-compatible servers#3630Xsidz wants to merge 1 commit into
Conversation
Fixes openai#3224: v2.34.0 added a credential check using `not self.api_key` which treats explicit api_key="" the same as no key provided. Track whether the caller explicitly passed api_key before the env-var lookup and skip the check when they did — restoring pre-2.34.0 behavior for users pointing at local servers that require no authentication.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e40da7dd67
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| provider_runtime is None | ||
| and _enforce_credentials | ||
| and not self.api_key | ||
| and not _api_key_provided |
There was a problem hiding this comment.
For OpenAI(api_key="", base_url=...) and the mirrored async path, construction now succeeds, but a standard generated request still fails before reaching the local server: _bearer_auth returns no header for the empty key, and _validate_headers then raises TypeError because Authorization is absent. Preserve the explicit-empty-key state through request-time validation, or automatically treat Authorization as intentionally omitted, so this change restores actual local-server calls rather than only client construction.
Useful? React with 👍 / 👎.
Summary
Fixes #3224.
v2.34.0 introduced credential validation that checks
not self.api_key, which is truthy for an explicitly-passed empty string. This broke users pointing the SDK at local OAI-compatible servers (llama.cpp, llamafile, LM Studio, vLLM) that passapi_key=""because they require no authentication — a pattern that worked in all prior versions.Root cause: the check fires on
api_key=""the same as on no key provided, because both result inself.api_key = "".Fix: capture whether the caller explicitly provided
api_keybefore the env-var lookup. If they did (even as""), skip the credential error. Applied to bothOpenAIandAsyncOpenAI.Test plan
OpenAI(api_key="", base_url="http://localhost:11434/v1")no longer raises.AsyncOpenAI(api_key="", base_url="http://localhost:11434/v1")no longer raises.OpenAI()with no env var still raisesOpenAIError: Missing credentials.tests/test_client.py+tests/test_models.py: 256 passed, 2 skipped, 0 failures.