feat(anthropic,fireworks,openai): use LangSmith gateway keys#38808
feat(anthropic,fireworks,openai): use LangSmith gateway keys#38808Mukil Loganathan (langchain-infra) wants to merge 5 commits into
Conversation
When LangSmith Gateway is enabled, provider integrations can use deployment-injected LangSmith keys without requiring duplicate provider-specific API key env vars.\n\nCo-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
| def _resolve_gateway_api_key() -> SecretStr | None: | ||
| return secret_from_env(_LANGSMITH_GATEWAY_API_KEY_ENV_VARS, default=None)() |
There was a problem hiding this comment.
🟡 Empty key masks valid gateway fallbacks
secret_from_env stops at the first variable that exists, even when its value is empty. Thus with gateway mode enabled and LANGSMITH_GATEWAY_API_KEY="" plus a valid LANGSMITH_API_KEY, this returns SecretStr("") instead of trying the documented fallback. OpenAI then replaces even a valid OPENAI_API_KEY with the empty secret; the identical helpers in Anthropic (line 98) and Fireworks (line 130) respectively fall through to the provider key or raise for a missing provider key rather than using the valid lower-priority gateway key. This makes authentication fail in environments that define the higher-priority variable as empty, despite a valid fallback being configured.
(Refers to lines 198-199)
Your feedback helps Open SWE learn. React with 👍 or 👎 to tell us if this review comment was useful.
| explicit_api_key = bool({"api_key", "openai_api_key"} & self.model_fields_set) | ||
| if _base_url_from_gateway and not explicit_api_key: |
There was a problem hiding this comment.
🟡 Explicit None disables gateway authentication
The public api_key type permits None, but field-set membership treats ChatOpenAI(..., api_key=None) as an explicit credential. In gateway mode this skips _resolve_gateway_api_key(), leaves both clients without authentication, and invocation fails even when LANGSMITH_GATEWAY_API_KEY is set. Before this change, a None value entered the gateway fallback; this matters for callers that forward an optional configuration value. Only a non-None explicitly supplied key should suppress environment resolution.
(Refers to lines 1224-1225)
Your feedback helps Open SWE learn. React with 👍 or 👎 to tell us if this review comment was useful.
| explicit_api_key = bool({"api_key", "openai_api_key"} & self.model_fields_set) | |
| if _base_url_from_gateway and not explicit_api_key: | |
| explicit_api_key = self.openai_api_key is not None and bool( | |
| {"api_key", "openai_api_key"} & self.model_fields_set | |
| ) | |
| if _base_url_from_gateway and not explicit_api_key: |
Description
When
LANGSMITH_GATEWAYis enabled, OpenAI, Anthropic, and Fireworks chat models now resolve gateway auth fromLANGSMITH_GATEWAY_API_KEY,LANGSMITH_API_KEY, thenLANGCHAIN_API_KEY, while preserving explicit constructor keys.Release Note
LangSmith Gateway mode can authenticate with existing LangSmith API key environment variables.
Test Plan
langsmith_gatewayunit tests for OpenAI, Anthropic, and FireworksMade by Open SWE