Fix: Custom providers sharing same base_url use wrong API credentials#14142
Closed
happy5318 wants to merge 1 commit into
Closed
Fix: Custom providers sharing same base_url use wrong API credentials#14142happy5318 wants to merge 1 commit into
happy5318 wants to merge 1 commit into
Conversation
When multiple custom_providers share the same base_url (e.g., a unified API gateway like New API), the credential pool matches by base_url and returns credentials from the first matching provider, not the requested one. This fix changes _resolve_named_custom_runtime to prioritize the provider's own api_key field before falling back to the shared credential pool, ensuring each provider uses its correct credentials. Fixes: credential pool returns wrong provider's API key when base_url is shared
19 tasks
This was referenced May 3, 2026
Contributor
|
Closing as already fixed on Triage notes (high confidence): If you still see this on the latest version, please reopen with reproduction steps. (Bulk-closed during a CLI triage sweep.) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #14141
When multiple
custom_providersshare the samebase_url(e.g., all pointing to a unified API gateway), the credential pool resolution in_resolve_named_custom_runtimereturns credentials from the first matching provider instead of the requested provider.Changes
_resolve_named_custom_runtime()inhermes_cli/runtime_provider.pyto prioritize the provider's ownapi_keyfield before falling back to the shared credential poolbase_urlwith other providersRoot Cause
The credential pool is keyed by
base_url. When multiple custom providers share the samebase_url, the pool lookup (get_custom_provider_pool_key()) returns whichever provider was registered first in the configuration, ignoring the actual requested provider.Testing
base_urlnow uses the correct API key for eachBackward Compatibility
This change is backward compatible. Providers that don't have their own
api_keywill still fall back to the credential pool and environment variables as before.