Skip to content

feat(anthropic,fireworks,openai): use LangSmith gateway keys#38808

Draft
Mukil Loganathan (langchain-infra) wants to merge 5 commits into
masterfrom
open-swe/langsmith-gateway-key-fallback
Draft

feat(anthropic,fireworks,openai): use LangSmith gateway keys#38808
Mukil Loganathan (langchain-infra) wants to merge 5 commits into
masterfrom
open-swe/langsmith-gateway-key-fallback

Conversation

@langchain-infra

Copy link
Copy Markdown
Contributor

Description

When LANGSMITH_GATEWAY is enabled, OpenAI, Anthropic, and Fireworks chat models now resolve gateway auth from LANGSMITH_GATEWAY_API_KEY, LANGSMITH_API_KEY, then LANGCHAIN_API_KEY, while preserving explicit constructor keys.

Release Note

LangSmith Gateway mode can authenticate with existing LangSmith API key environment variables.

Test Plan

  • langsmith_gateway unit tests for OpenAI, Anthropic, and Fireworks

Made by Open SWE

ccurme (ccurme) and others added 5 commits July 9, 2026 10:37
When LangSmith Gateway is enabled, provider integrations can use deployment-injected LangSmith keys without requiring duplicate provider-specific API key env vars.\n\nCo-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
@github-actions github-actions Bot added anthropic `langchain-anthropic` package issues & PRs feature For PRs that implement a new feature; NOT A FEATURE REQUEST fireworks `langchain-fireworks` package issues & PRs integration PR made that is related to a provider partner package integration internal openai `langchain-openai` package issues & PRs size: M 200-499 LOC labels Jul 12, 2026

@open-swe open-swe Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Open SWE Review found 2 potential issues.

Open in WebView Open SWE trace

Comment on lines +198 to +199
def _resolve_gateway_api_key() -> SecretStr | None:
return secret_from_env(_LANGSMITH_GATEWAY_API_KEY_ENV_VARS, default=None)()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Empty key masks valid gateway fallbacks

secret_from_env stops at the first variable that exists, even when its value is empty. Thus with gateway mode enabled and LANGSMITH_GATEWAY_API_KEY="" plus a valid LANGSMITH_API_KEY, this returns SecretStr("") instead of trying the documented fallback. OpenAI then replaces even a valid OPENAI_API_KEY with the empty secret; the identical helpers in Anthropic (line 98) and Fireworks (line 130) respectively fall through to the provider key or raise for a missing provider key rather than using the valid lower-priority gateway key. This makes authentication fail in environments that define the higher-priority variable as empty, despite a valid fallback being configured.

(Refers to lines 198-199)


Your feedback helps Open SWE learn. React with 👍 or 👎 to tell us if this review comment was useful.

Comment on lines +1224 to +1225
explicit_api_key = bool({"api_key", "openai_api_key"} & self.model_fields_set)
if _base_url_from_gateway and not explicit_api_key:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Explicit None disables gateway authentication

The public api_key type permits None, but field-set membership treats ChatOpenAI(..., api_key=None) as an explicit credential. In gateway mode this skips _resolve_gateway_api_key(), leaves both clients without authentication, and invocation fails even when LANGSMITH_GATEWAY_API_KEY is set. Before this change, a None value entered the gateway fallback; this matters for callers that forward an optional configuration value. Only a non-None explicitly supplied key should suppress environment resolution.

(Refers to lines 1224-1225)


Your feedback helps Open SWE learn. React with 👍 or 👎 to tell us if this review comment was useful.

Suggested change
explicit_api_key = bool({"api_key", "openai_api_key"} & self.model_fields_set)
if _base_url_from_gateway and not explicit_api_key:
explicit_api_key = self.openai_api_key is not None and bool(
{"api_key", "openai_api_key"} & self.model_fields_set
)
if _base_url_from_gateway and not explicit_api_key:

Base automatically changed from cc/gateway-base-url to master July 23, 2026 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

anthropic `langchain-anthropic` package issues & PRs feature For PRs that implement a new feature; NOT A FEATURE REQUEST fireworks `langchain-fireworks` package issues & PRs integration PR made that is related to a provider partner package integration internal openai `langchain-openai` package issues & PRs size: M 200-499 LOC

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants