fix: ensure API key passthrough works for OpenAI embedding models

[onematchfox]

At present, one can set apiKeyPassthrough: true on an embedding model, however the field is completely ignored. This PR ensures that the field is honored in line with the implementation for chat completions calls.

[onematchfox]

CI failures seem unrelated to this work. Linting issues were introduced in #2442. Unit tests + upgrade tests also failed on that PRs merge commit (not sure when they started failing though).

[Copilot]

Pull request overview

This PR makes apiKeyPassthrough effective for embedding model calls by propagating the incoming request’s Bearer token into embedding SDK/client authentication, aligning embedding behavior with existing chat/completions passthrough patterns across the Python ADK runtime and Go ADK embedding implementations.

Changes:

• Add api_key_passthrough to embedding config types and wire it into OpenAI/Azure OpenAI embedding client construction (Python).
• Introduce a shared Bearer-token ContextVar and set it during A2A request conversion so background memory/embedding consumers can access the caller token (Python).
• Plumb api_key_passthrough through Go ADK config/types and add passthrough request options + tests for OpenAI/Azure OpenAI/Foundry embeddings (Go), plus docs clarification.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/packages/kagent-adk/tests/unittests/test_embedding.py	Adds unit tests validating embedding API key passthrough behavior and token reset between tests.
python/packages/kagent-adk/tests/unittests/test_agent_executor.py	Adds tests ensuring bearer token context is set/cleared based on incoming Authorization header.
python/packages/kagent-adk/src/kagent/adk/types.py	Adds api_key_passthrough to EmbeddingConfig.
python/packages/kagent-adk/src/kagent/adk/models/_embedding.py	Implements passthrough API key selection and passes it into OpenAI/Azure OpenAI embedding SDK clients.
python/packages/kagent-adk/src/kagent/adk/_llm_passthrough_plugin.py	Reuses shared bearer token extraction helper rather than duplicating logic.
python/packages/kagent-adk/src/kagent/adk/_bearer_token.py	Introduces shared bearer token ContextVar and extract_bearer_token helper.
python/packages/kagent-adk/src/kagent/adk/_agent_executor.py	Stores extracted Bearer token into a ContextVar during request conversion for downstream consumers.
go/api/adk/types.go	Adds api_key_passthrough to EmbeddingConfig and propagates it through model→embedding conversions.
go/api/adk/types_test.go	Adds tests for EmbeddingConfig JSON unmarshalling and model→embedding passthrough propagation.
go/adk/pkg/models/openai.go	Refactors passthrough option resolution to use shared PassthroughToken.
go/adk/pkg/models/base.go	Adds PassthroughToken helper for consistent context token resolution.
go/adk/pkg/models/anthropic.go	Refactors Anthropic passthrough to use shared PassthroughToken.
go/adk/pkg/embedding/foundry_embedding_test.go	Adds Foundry embedding passthrough tests and reuses shared embedding response helper.
go/adk/pkg/embedding/embedding.go	Implements embedding passthrough request options and adds passthrough placeholder handling for Azure-family providers.
go/adk/pkg/embedding/embedding_test.go	Adds OpenAI/Azure OpenAI embedding passthrough tests and consolidates embedding response helpers.
docs/architecture/crds-and-types.md	Documents which embedding providers honor apiKeyPassthrough under memory.modelConfig.

Suppressed comments (1)

go/adk/pkg/embedding/embedding.go:442

• Same as Azure OpenAI: enabling api_key_passthrough currently overwrites any configured/static Foundry API key with the "passthrough" placeholder. If the caller context does not include a bearer token, requests will be made with an invalid Api-Key: passthrough instead of falling back to the static key.

	// past DefaultAzureCredential resolution the same way it does for chat.
	apiKey := os.Getenv(azureai.FoundryAPIKeyEnvVar)
	if cfg.APIKeyPassthrough {
		apiKey = "passthrough"
	}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[supreme-gg-gg]

this lgtm, the CI failures are due to other works on api v2

[EItanya]

CI failures seem unrelated to this work. Linting issues were introduced in #2442. Unit tests + upgrade tests also failed on that PRs merge commit (not sure when they started failing though).

Hey there, we discussed this during the community meeting and in my recent blog, but main has officially deviated from 0.10.x completely in preparation for the new API + using Substrate as the core runtime.

Changes which specifically target the old release should be opened against release/v0.10.x. If it's something which will impact both then we can either backport or forward port depending on what's easier for the situation.