fix: ensure API key passthrough works for OpenAI embedding models - #2494
Merged
EItanya merged 1 commit intoAug 19, 2026
Merged
Conversation
At present, one can set `apiKeyPassthrough: true` on an embedding model, however the field is completely ignored. This PR ensures that the field is honored in line with the implementation for chat completions calls. Signed-off-by: Brian Fox <878612+onematchfox@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports #2457 to release/v0.10.x, ensuring apiKeyPassthrough is honored for OpenAI-family embedding calls (similar to chat/completions passthrough behavior) by propagating config through both the Python ADK and Go ADK embedding providers.
Changes:
- Add
api_key_passthroughto embedding configuration and use the incoming Bearer token as the OpenAI/Azure OpenAI SDKapi_keyfor embedding requests (Python). - Introduce a shared Bearer-token ContextVar utility and wire token extraction into the request executor / passthrough plugin path (Python).
- Propagate
api_key_passthroughthrough Go ADK embedding config and apply request options to override API key per request; add/extend tests for passthrough behavior (Go).
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| python/packages/kagent-adk/tests/unittests/test_embedding.py | Adds unit tests validating embedding API-key passthrough behavior for OpenAI/Azure OpenAI. |
| python/packages/kagent-adk/src/kagent/adk/types.py | Extends EmbeddingConfig with api_key_passthrough. |
| python/packages/kagent-adk/src/kagent/adk/models/_embedding.py | Implements passthrough API key resolution for OpenAI-family embedding calls. |
| python/packages/kagent-adk/src/kagent/adk/_llm_passthrough_plugin.py | Refactors bearer-token extraction into a shared helper. |
| python/packages/kagent-adk/src/kagent/adk/_bearer_token.py | Introduces shared bearer-token ContextVar + extraction helper. |
| python/packages/kagent-adk/src/kagent/adk/_agent_executor.py | Extracts bearer token from request headers and stores it in a ContextVar for downstream consumers. |
| go/api/adk/types.go | Adds api_key_passthrough to Go EmbeddingConfig and propagates it from models. |
| go/api/adk/types_test.go | Adds coverage for JSON unmarshal + propagation of APIKeyPassthrough. |
| go/adk/pkg/models/openai.go | Centralizes passthrough token resolution via PassthroughToken. |
| go/adk/pkg/models/base.go | Adds PassthroughToken(ctx, enabled) helper for consistent passthrough handling. |
| go/adk/pkg/models/anthropic.go | Switches to shared PassthroughToken helper. |
| go/adk/pkg/embedding/foundry_embedding_test.go | Adds Foundry embedding passthrough tests and cleans up response fixture generation. |
| go/adk/pkg/embedding/embedding.go | Applies passthrough request options for OpenAI-family embedding requests; adjusts Azure/Foundry implicit auth handling. |
| go/adk/pkg/embedding/embedding_test.go | Adds OpenAI/Azure embedding passthrough tests and reuses a shared embedding response helper. |
| docs/architecture/crds-and-types.md | Documents provider limitations for apiKeyPassthrough when used via memory.modelConfig. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
542
to
551
| # Normal flow: set request headers to session state | ||
| headers = context.call_context.state.get("headers", {}) | ||
| headers = headers if isinstance(headers, dict) else {} | ||
| state_changes = { | ||
| "headers": headers, | ||
| } | ||
| # Also stash the token in a ContextVar for consumers with no | ||
| # callback_context of their own - see _bearer_token.py. | ||
| bearer_token.set(extract_bearer_token(headers)) | ||
|
|
EItanya
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports #2457 to
release/v0.10.x