ollama streaming auth header

[akshaydeo]

Summary

Adds Bearer token authentication support to the Ollama provider's streaming endpoints. Previously, the streaming methods for text completion and chat completion always passed nil for the auth header, meaning API keys configured for Ollama were silently ignored during streaming requests.

Issues

Closes #3905

Changes

• When a non-empty key value is present, a Bearer token Authorization header is now constructed and passed to the OpenAI-compatible streaming handlers for both TextCompletionStream and ChatCompletionStream
• If no key is configured, the auth header remains nil, preserving backward compatibility with unauthenticated local Ollama instances

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Configure an Ollama provider with an API key (e.g., when using a hosted or authenticated Ollama instance) and issue a streaming chat or text completion request. Verify the Authorization: Bearer <key> header is included in the outgoing request.

go test ./core/providers/ollama/...

Breaking changes

• Yes
• No

Related issues

Security considerations

API keys are now correctly forwarded as Bearer tokens in streaming requests to Ollama. Ensure keys are stored and retrieved securely via the existing key management mechanism, as they will now be included in outbound HTTP headers for streaming calls.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• Bug Fixes
  • Ollama streaming requests now support authentication via bearer tokens for both text and chat completions, enabling proper token-based authentication when API keys are provided.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Ollama streaming completions for both text and chat now conditionally derive Authorization: Bearer <token> headers from the provided API key and pass them into shared OpenAI streaming handlers instead of always passing nil, enabling token-based authentication when a key is set.

Changes

Ollama Streaming Authentication

Layer / File(s)	Summary
Ollama streaming token authentication core/providers/ollama/ollama.go	TextCompletionStream and ChatCompletionStream both now conditionally build an Authorization header map from key.Value and pass it to openai.HandleOpenAITextCompletionStreaming and openai.HandleOpenAIChatCompletionStreaming respectively, replacing nil to enable token authentication.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested reviewers

• danpiths

Poem

🐰 A bearer token finds its way,
Through Ollama's streaming display,
Two paths align with auth so fine,
No longer nil, credentials shine,
Security blooms with each request's call! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR closes issue #3905 regarding Ollama streaming authentication, but the linked issue #123 concerns Files API Support for providers, which is unrelated to this authentication fix.	Verify the correct issue is linked. The PR description references closing #3905, but only #123 appears in linked_issues. Ensure #3905 is properly linked in the PR.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding Bearer token authentication header support to Ollama streaming endpoints.
Description check	✅ Passed	The description is well-structured, following the template with all major sections completed including Summary, Changes, Type of change, Affected areas, How to test, Breaking changes, and Security considerations.
Out of Scope Changes check	✅ Passed	The code changes are narrowly focused on adding Bearer token authentication to Ollama streaming endpoints, which aligns with the PR objectives despite the linked issue mismatch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-30-ollama_streaming_auth_header

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[akshaydeo]

• ollama streaming auth header #3906 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@core/providers/ollama/ollama.go`:
- Around line 156-165: Add table-driven regression tests that verify
Authorization header propagation for all streaming entrypoints: the text path
calling openai.HandleOpenAITextCompletionStreaming (uses
provider.streamingClient + GetPathFromContext), the chat streaming path
(HandleOpenAIChatCompletionStreaming), and the ResponsesStream fallback; for
each entrypoint run cases where key.Value.GetValue() is non-empty and empty and
assert the outbound request includes "Authorization: Bearer <token>" when set
and omits the header when empty. Wire a test HTTP server to capture incoming
request headers from provider.streamingClient and assert header presence/absence
in each table case, and add tests named to reflect the methods (e.g.,
TestTextStreamingAuthPropagation, TestChatStreamingAuthPropagation,
TestResponsesStreamAuthPropagation).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0fababf4-5a9b-426d-95d6-180181affc6f

📥 Commits

Reviewing files that changed from the base of the PR and between f56c4b9 and 6bbe011.

📒 Files selected for processing (1)

• core/providers/ollama/ollama.go

[greptile-apps]

Confidence Score: 4/5

Safe to merge; the change is a targeted two-site fix that aligns streaming auth with the already-correct non-streaming paths and introduces no new control-flow or side effects.

The auth-header logic is correct and consistent with what the shared OpenAI handlers do internally. The only gap is the absence of test coverage for the newly exercised code path — previously nil was passed, so a regression here would be invisible without a test asserting the header is sent.

core/providers/ollama/ollama.go — specifically the two new authHeader blocks and their interaction with networkConfig.ExtraHeaders ordering in the shared streaming helpers.

Important Files Changed

Filename	Overview
core/providers/ollama/ollama.go	Adds Authorization: Bearer header to the TextCompletionStream and ChatCompletionStream paths, matching what the non-streaming handlers already do internally; the fix is logically correct but has no accompanying test coverage.

_{Reviews (1): Last reviewed commit: "ollama streaming auth header" | Re-trigger Greptile}

[akshaydeo]

Merge activity

• May 30, 1:27 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 30, 1:27 PM UTC: @akshaydeo merged this pull request with Graphite.