From 8718d2b62f7ef1a028bd6ede3a535415ab44afd8 Mon Sep 17 00:00:00 2001
From: TengSivtean <126131902+TengSivtean@users.noreply.github.com>
Date: Thu, 13 Aug 2026 14:42:34 +0700
Subject: [PATCH] fix(providers): kilo-gateway authType should be optional, not
 apikey (#10086)

Probed live: /chat/completions answers HTTP 200 with no Authorization
header (kilo-auto/free routed to stepfun/step-3.7-flash). A real key
still raises limits, so this matches the ovhcloud/pollinations pattern
of authType: "optional" rather than "apikey".

Fixes #10068
---
 open-sse/config/providers/registry/kilo-gateway/index.ts | 7 ++++++-
 tests/unit/provider-credential-requirement.test.ts       | 2 ++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/open-sse/config/providers/registry/kilo-gateway/index.ts b/open-sse/config/providers/registry/kilo-gateway/index.ts
index 783f812864..67b57f1fa7 100644
--- a/open-sse/config/providers/registry/kilo-gateway/index.ts
+++ b/open-sse/config/providers/registry/kilo-gateway/index.ts
@@ -1,5 +1,10 @@
 import type { RegistryEntry } from "../../shared.ts";
 
+/**
+ * The key is genuinely optional: probed live 2026-08-11 with no Authorization
+ * header, /chat/completions still answered 200 (kilo-auto/free routed to
+ * stepfun/step-3.7-flash) — so authType stays "optional", matching ovhcloud.
+ */
 export const kilo_gatewayProvider: RegistryEntry = {
   id: "kilo-gateway",
   alias: "kg",
@@ -7,7 +12,7 @@ export const kilo_gatewayProvider: RegistryEntry = {
   executor: "default",
   baseUrl: "https://api.kilo.ai/api/gateway/chat/completions",
   modelsUrl: "https://api.kilo.ai/api/gateway/models",
-  authType: "apikey",
+  authType: "optional",
   authHeader: "bearer",
   models: [
     { id: "kilo-auto/frontier", name: "Kilo Auto Frontier" },
diff --git a/tests/unit/provider-credential-requirement.test.ts b/tests/unit/provider-credential-requirement.test.ts
index 5931842732..531b982fc0 100644
--- a/tests/unit/provider-credential-requirement.test.ts
+++ b/tests/unit/provider-credential-requirement.test.ts
@@ -18,6 +18,8 @@ test("classifies each credential model from the real registries", () => {
   assert.equal(getCredentialRequirement("kilocode"), "optional");
   // Verified live 2026-07-20: answers with no Authorization header, 403s on a bad key.
   assert.equal(getCredentialRequirement("ovhcloud"), "optional");
+  // Verified live 2026-08-11: HTTP 200 with no Authorization header (#10068).
+  assert.equal(getCredentialRequirement("kilo-gateway"), "optional");
   // OAuth: nothing to paste, but the user still signs in.
   assert.equal(getCredentialRequirement("agy"), "oauth");
   // Ordinary key-gated provider.