mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-17 20:52:15 +03:00
dc32732b2a
The 9 media *ExampleCard components under media-providers/components used the masked value from useApiKey() (sk-xxxx****yyyy) as an Authorization: Bearer header, which the gateway always rejects (AUTH_002) once REQUIRE_API_KEY is enabled. Mirror the LlmChatCard fix (#3503): authenticate via the dashboard session (credentials: "same-origin") and forward the selected key's id via x-omniroute-playground-key-id instead of its secret. buildCurl now keeps the <your-api-key> placeholder instead of the masked value. Adds tests/unit/bug-9935-masked-bearer.test.ts as the permanent regression guard (asserts none of the 9 cards embed apiKey as a raw Bearer token). Refs #9935 Co-authored-by: adevwithpurpose <adevwithpurpose@users.noreply.github.com>