remote::passthrough inference provider broken on openai >= 2.34.0 — all requests return 500

[NickGagan]

System Info

System Info

OS: macOS 26.5.2 (arm64)
Python: 3.14.5
OGX: 1.2.1.dev32+g5969018e0
openai: 2.46.0

Information

• The official example scripts
• My own modified scripts

🐛 Describe the bug

The remote::passthrough inference provider is broken on all OGX versions since v1.1.0. Every request — inference calls, model listing, and the background model refresh — fails with a credentials error from the openai SDK.

The root cause is that _get_openai_client() (passthrough.py#L105) hardcodes api_key="" when constructing AsyncOpenAI. This was intentional — auth is handled via default_headers — but openai 2.34.0 added a constructor-level credentials enforcement check (openai/_client.py#L820) that raises Missing credentials when api_key is empty, before any headers are read or any request is made.

OGX required openai>=2.30.0 when the passthrough was written. PR #6047 bumped the requirement to >=2.41.0 in v1.1.0, silently crossing the 2.34.0 boundary. The passthrough was never updated. The bug is invisible in the test suite because all tests that exercise _get_openai_client() mock AsyncOpenAI entirely.

Error logs

Background model refresh (logged at WARNING on startup):

WARNING ogx.core.routing_tables.models:104 Model refresh failed
        category=core::routing_tables
        error=Missing credentials. Please pass an `api_key`, `workload_identity`,
        `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.
        provider_id=anthropic-passthrough

POST /v1/responses (500 returned to caller):

{"detail":"An unexpected error occurred while generating the response."}

Underlying SDK error (not surfaced to caller):

openai.OpenAIError: Could not resolve authentication method. Expected either
api_key or admin_api_key to be set. Or for one of the `Authorization` or
`Authorization` headers to be explicitly omitted

GET /v1/models returns {"object":"list","data":[]} with no error — the exception is caught silently in _get_dynamic_models_from_provider_data and logged only at DEBUG level.

Expected behavior

POST /v1/responses should forward the request to the configured downstream and return the model's response. GET /v1/models should return the models available from the downstream provider. The background refresh should successfully register models from the downstream.

Suggested fix: add _enforce_credentials=False to the AsyncOpenAI constructor in _get_openai_client(). This parameter is available in openai >= 2.40.0, which covers all versions OGX currently requires (>= 2.41.0), and is the correct way to signal that auth is handled via default_headers rather than the SDK's own credential mechanism.

return AsyncOpenAI(
    base_url=f"{base_url.rstrip('/')}/v1",
    api_key="",
+   _enforce_credentials=False,
    default_headers=request_headers or None,
    **build_http_client(self.config.network),
)

Extra debugging info: passthrough-debug.txt