fix(proxy): swap placeholder secrets in auth headers unconditionally#153
Closed
vinit-patel-athena wants to merge 1 commit into
Closed
Conversation
The URL-based credential resolution path (introduced in 1dbcb8c) only looked up per-user auth profiles and set Authorization: Bearer. When no auth profile existed (system API key from .env), the x-api-key header still contained the lobu_secret_* placeholder, which was sent to the upstream provider and rejected as invalid. This happened because the placeholder swap logic was guarded by an `else` branch that only ran when the URL-based path was not taken. System keys (e.g. ANTHROPIC_API_KEY) are stored as UUID placeholder mappings in Redis, not as auth profiles, so the URL-based path found no profile and the legacy swap path was skipped entirely. Split credential resolution into two unconditional steps: 1. Auth profile lookup (when agentId is in the URL) 2. Placeholder swap for any auth headers still containing lobu_secret_* Step 2 now runs regardless of whether step 1 found a profile, so system keys in x-api-key and Authorization headers are always resolved. OAuth users are unaffected since their credentials use the "lobu-proxy" marker (not a UUID placeholder) and are resolved in step 1. Made-with: Cursor
4 tasks
buremba
added a commit
that referenced
this pull request
May 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.envand keys entered through the settings UI)Authorization: Bearer. When the credential was an API key (not OAuth), thex-api-keyheader still contained thelobu_secret_*placeholder, which was sent to the upstream provider and rejected as invalid.lobu_secret_*values in auth headersProblem
The
elsebranch guarding the placeholder swap meant it only ran when the URL-based path was not taken. Since all modern deployments include/a/{agentId}in the proxy URL, the URL-based path was always entered and the placeholder swap was always skipped.This affected:
ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKENin.envauthType: "api-key")OAuth users were unaffected because OAuth credentials flow through
CLAUDE_CODE_OAUTH_TOKENwhich uses the"lobu-proxy"marker andAuthorization: Bearerheader (resolved in step 1).Test plan
ANTHROPIC_API_KEYin.env(no OAuth), send a message via REST API, verify the agent respondsMade with Cursor