Credentials: error handling for unsupported providers

backend/app/api/docs/credentials/create.md

@@ -1,3 +1,46 @@
 Persist new credentials for the current organization and project.
 
-Credentials are encrypted and stored securely for provider integrations (OpenAI, Langfuse, etc.). Only one credential per provider is allowed per organization-project combination.
+Credentials are encrypted and stored securely for provider integrations (OpenAI, Langfuse, etc.). Only one credential per provider is allowed per organization-project combination. You can send credentials for a single provider or multiple providers in one request. Refer to the examples below for the required input parameters for each provider.
+
+### Supported Providers:
+- **LLM:** openai, sarvamai, google(gemini)
+- **Observability:** langfuse
+- **Audio:** elevenlabs
+
+### Examples:
+
+#### Single Provider
+```json
+{
+  "credential": {
+    "openai": {
+      "api_key": "sk-proj-..."
+    }
+  }
+}
+```
+
+#### Multiple Providers
+```json
+{
+  "credential": {
+    "openai": {
+      "api_key": "sk-proj-..."
+    },
+    "google": {
+      "api_key": "AIzaSy..."
+    },
+    "sarvamai": {
+      "api_key": "sarvam-..."
+    },
+    "elevenlabs": {
+      "api_key": "sk_..."
+    },
+    "langfuse": {
+      "public_key": "pk-lf-....",
+      "secret_key": "sk-lf-...",
+      "host": "https://cloud.langfuse.com"
+    }
+  }
+}
+```

backend/app/api/docs/onboarding/onboarding.md

@@ -30,8 +30,9 @@
 - We’ve also included a list of the providers currently supported by kaapi.
 
    ### Supported Providers
-   - **LLM:** openai
+   - **LLM:** openai, google, sarvamai
    - **Observability:** langfuse
+   - **Audio:** elevenlabs
 
    ### Example: For sending multiple credentials -
    ```
@@ -41,9 +42,24 @@
          "api_key": "sk-proj-..."
        }
      },
+     {
+       "google": {
+         "api_key": "AIzaSy..."
+       }
+     },
+     {
+       "sarvamai": {
+         "api_key": "sarvam-..."
+       }
+     },
+     {
+       "elevenlabs": {
+         "api_key": "sk_..."
+       }
+     },
      {
        "langfuse": {
-         "public_key": "pk-lf-...",
+         "public_key": "pk-lf-....",
          "secret_key": "sk-lf-...",
          "host": "https://cloud.langfuse.com"
        }

backend/app/api/routes/credentials.py

@@ -85,7 +85,11 @@ def read_provider_credential(
     provider: str,
     _current_user: AuthContextDep,
 ):
-    provider_enum = validate_provider(provider)
+    try:
+        provider_enum = validate_provider(provider)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
     credential = get_provider_credential(
         session=session,
         org_id=_current_user.organization_.id,
@@ -143,7 +147,11 @@ def delete_provider_credential(
     provider: str,
     _current_user: AuthContextDep,
 ):
-    provider_enum = validate_provider(provider)
+    try:
+        provider_enum = validate_provider(provider)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
     remove_provider_credential(
         session=session,
         org_id=_current_user.organization_.id,

backend/app/core/providers.py

@@ -1,5 +1,5 @@
 import logging
-from typing import Dict, List, Optional
+from typing import Dict, List
 from enum import Enum
 from dataclasses import dataclass
 
@@ -10,7 +10,6 @@ class Provider(str, Enum):
     """Enumeration of supported credential providers."""
 
     OPENAI = "openai"
-    AWS = "aws"
     LANGFUSE = "langfuse"
     GOOGLE = "google"
     SARVAMAI = "sarvamai"
@@ -27,9 +26,6 @@ class ProviderConfig:
 # Provider configurations
 PROVIDER_CONFIGS: Dict[Provider, ProviderConfig] = {
     Provider.OPENAI: ProviderConfig(required_fields=["api_key"]),
-    Provider.AWS: ProviderConfig(
-        required_fields=["access_key_id", "secret_access_key", "region"]
-    ),
     Provider.LANGFUSE: ProviderConfig(
         required_fields=["secret_key", "public_key", "host"]
     ),

backend/app/crud/credentials.py

@@ -11,6 +11,7 @@
 from app.core.util import now
 from app.models import Credential, CredsCreate, CredsUpdate
 
+
 logger = logging.getLogger(__name__)
 
 
@@ -27,9 +28,13 @@ def set_creds_for_org(
         raise HTTPException(400, "No credentials provided")
 
     for provider, credentials in creds_add.credential.items():
-        # Validate provider and credentials
-        validate_provider(provider)
-        validate_provider_credentials(provider, credentials)
+        try:
+            validate_provider_credentials(provider, credentials)
+        except ValueError as e:
+            logger.error(
+                f"[set_creds_for_org] Validation error | project_id: {project_id}, provider: {provider}, error: {str(e)}"
+            )
+            raise HTTPException(status_code=400, detail=str(e))
 
         # Encrypt entire credentials object
         encrypted_credentials = encrypt_credentials(credentials)
@@ -144,7 +149,10 @@ def get_provider_credential(
     Raises:
         HTTPException: If credentials are not found
     """
-    validate_provider(provider)
+    try:
+        validate_provider(provider)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
 
     statement = select(Credential).where(
         Credential.organization_id == org_id,
@@ -176,8 +184,13 @@ def update_creds_for_org(
     if not creds_in.provider or not creds_in.credential:
         raise ValueError("Provider and credential must be provided")
 
-    validate_provider(creds_in.provider)
-    validate_provider_credentials(creds_in.provider, creds_in.credential)
+    try:
+        validate_provider_credentials(creds_in.provider, creds_in.credential)
+    except ValueError as e:
+        logger.error(
+            f"[update_creds_for_org] Validation error | organization_id: {org_id}, project_id: {project_id}, provider: {creds_in.provider}, error: {str(e)}"
+        )
+        raise HTTPException(status_code=400, detail=str(e))
 
     # Encrypt the entire credentials object
     encrypted_credentials = encrypt_credentials(creds_in.credential)
@@ -216,8 +229,6 @@ def remove_provider_credential(
     Raises:
         HTTPException: If credentials not found or deletion fails
     """
-    validate_provider(provider)
-
     # Verify credentials exist before attempting delete
     creds = get_provider_credential(
         session=session,

backend/app/models/onboarding.py

@@ -90,39 +90,30 @@ def _validate_credential_list(cls, v: list[dict[str, dict[str, str]]] | None):
 
         if not isinstance(v, list):
             raise TypeError(
-                "credential must be a list of single-key dicts (e.g., {'openai': {...}})."
+                "Credential must be a list of single-key dicts (e.g., {'openai': {...}})."
             )
 
-        errors: list[str] = []
+        for item in v:
+            if not isinstance(item, dict):
+                raise TypeError(
+                    "Credential must be a dict with a single provider key like {'openai': {...}}."
+                )
+            if len(item) != 1:
+                raise ValueError(
+                    "Credential must have exactly one provider key like {'openai': {...}}."
+                )
 
-        for idx, item in enumerate(v):
-            try:
-                if not isinstance(item, dict):
-                    raise TypeError(
-                        "must be a dict with a single provider key like {'openai': {...}}."
-                    )
-                if len(item) != 1:
-                    raise ValueError(
-                        "must have exactly one provider key like {'openai': {...}}."
-                    )
+            (provider_key,) = item.keys()
+            values = item[provider_key]
 
-                (provider_key,) = item.keys()
-                values = item[provider_key]
+            validate_provider(provider_key)
 
-                validate_provider(provider_key)
+            if not isinstance(values, dict):
+                raise ValueError(
+                    f"Value for provider '{provider_key}' must be an object/dict."
+                )
 
-                if not isinstance(values, dict):
-                    raise TypeError(
-                        f"value for provider '{provider_key}' must be an object/dict."
-                    )
-
-                validate_provider_credentials(provider_key, values)
-
-            except (TypeError, ValueError) as e:
-                errors.append(f"[{idx}] {e}")
-
-        if errors:
-            raise ValueError("credential validation failed:\n" + "\n".join(errors))
+            validate_provider_credentials(provider_key, values)
 
         return v