fix update passthrough docs

[TejasGhatte]

Summary

Clarifies that passthrough endpoints are not credential proxies — Bifrost always selects and injects its own provider key, and any provider credentials supplied by the caller are stripped before the request is forwarded upstream.

Changes

• Added a Warning callout making it explicit that callers must authenticate with a Bifrost virtual key, not a provider API key, and that provider keys in the request are never forwarded.
• Added a Note callout explaining that Claude Code OAuth tokens (sk-ant-oat…) are handled on the regular /anthropic route, not via passthrough.
• Updated the "How it works" numbered steps to explicitly describe Bifrost's key selection and credential-stripping behavior.
• Updated curl examples for Anthropic, GenAI (Gemini), and Vertex passthrough to use <YOUR-BIFROST-VIRTUAL-KEY> instead of raw provider API key placeholders.
• Replaced the Azure-specific auth note in the Notes section with a provider-agnostic statement covering all passthrough endpoints (authorization, api-key, x-api-key, x-goog-api-key).
• Added a note about the direct API keys exception, requiring both allow_direct_keys server-side and x-bf-direct-key: true per-request.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Review the updated passthrough documentation and verify:

• The Warning and Note callouts render correctly.
• curl examples reference <YOUR-BIFROST-VIRTUAL-KEY> consistently across Anthropic, GenAI, and Vertex sections.
• The Notes section accurately reflects the behavior for all passthrough endpoints, not just Azure.

Breaking changes

• Yes
• No

Security considerations

This change reinforces that provider API keys should never be sent by callers on passthrough requests — Bifrost strips them regardless. The documentation now makes this behavior explicit, reducing the risk of users inadvertently exposing provider credentials or expecting them to be forwarded upstream.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f843a7e-6319-46e4-bbd8-9f184a93d4a3

📥 Commits

Reviewing files that changed from the base of the PR and between 4a51039 and 2d45aa8.

📒 Files selected for processing (1)

• docs/integrations/passthrough.mdx

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/integrations/passthrough.mdx

---

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Clarified how passthrough requests handle provider credentials and upstream authentication.
  • Updated examples to use Bifrost virtual keys.
  • Added guidance for Claude Code OAuth authentication on the /anthropic endpoint.
  • Documented the direct provider-key exception, including required server configuration and request headers.

Walkthrough

Passthrough documentation now explains Bifrost provider-key selection, virtual-key authentication, Claude Code OAuth handling, and the conditions for direct provider API keys.

Changes

Passthrough authentication

Layer / File(s)	Summary
Authentication guidance and examples docs/integrations/passthrough.mdx	The documentation explains provider credential removal and configured-key injection. cURL examples use Bifrost virtual keys. Notes document Claude Code OAuth and the allow_direct_keys plus x-bf-direct-key: true exception.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• maximhq/bifrost#5664: Updates the same passthrough documentation with related virtual-key and provider-credential guidance.
• maximhq/bifrost#5833: Implements related Anthropic passthrough header and provider credential handling.
• maximhq/bifrost#5904: Implements related Claude Code OAuth passthrough behavior.

Suggested reviewers: r-droid101

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies the passthrough documentation update, but it is somewhat awkward and broad.
Description check	✅ Passed	The description follows the template, explains the documentation changes, testing steps, security impact, and affected area.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 08-06-fix_update_passthrough_docs

---

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

tejas ghatte seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[TejasGhatte]

• fix: add anthropic error branch on stripping on encrypted content #5960
• fix: cost in usd ticks for xai usage #5950
• tests: harness tests for bedrock documents #5949
• fix: bedrock files handling in inference #5947
• video requests info in logs ui #5946
• fix update passthrough docs #5906 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/integrations/passthrough.mdx`:
- Around line 307-308: Add a supported Bifrost virtual-key header to the Azure
cURL example near the Azure request example, using the same authentication flow
described in the passthrough guidance. If the example intentionally omits
authentication because inference authentication is disabled, explicitly state
that prerequisite; otherwise, ensure the example includes the virtual key and
remains consistent with provider behavior.
- Around line 36-38: Update the Warning in the passthrough documentation to
describe provider-key suppression as the default virtual-key flow, not an
absolute rule. Explicitly document the direct-key exception: when
client.allow_direct_keys and x-bf-direct-key: true are enabled, raw provider
keys are accepted via Authorization: Bearer, x-api-key, or x-goog-api-key,
matching transports/config.schema.json and provider behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2810ee8a-b35c-4f0b-ae2f-497db02b35ed

📥 Commits

Reviewing files that changed from the base of the PR and between 4a51039 and fbb94ce.

📒 Files selected for processing (1)

• docs/integrations/passthrough.mdx

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[akshaydeo]

Merge activity

• Aug 10, 3:13 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Aug 10, 3:15 PM UTC: @akshaydeo merged this pull request with Graphite.