fix(kb): resolve provider API key from env var over stored key#89
Merged
Conversation
Knowledge bases persisted the OpenAI/Gemini API key at creation time
(in KB params, reranking params, and the embedding model's args). When
keys are rotated, every KB kept using the stale stored key and failed
with 401 Incorrect API key.
Make the environment variable take precedence over any stored key on all
KB key-resolution paths, so a rotated key can be updated in one place
without recreating knowledge bases:
- llm_client.py: embedding model prefers {PROVIDER}_API_KEY env var
(gemini also honors GOOGLE_API_KEY) before the stored api_key.
- controller.py: reranking model uses the same env-first resolution;
add missing `import os`.
- openai_handler.py: add `_resolve_api_key()` (env-first, keyed off
api_key_name so provider subclasses stay correct) and route the
predict/describe/validate/finetune sites through it.
Follow-up (discussed, not in this PR): stop persisting the secret at
creation and scrub existing rows so env becomes the sole source of
truth and these overrides can be removed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gabrielbressan-tfy
requested review from
gnumoksha,
magroski and
patrickadeelino
and removed request for
gnumoksha
Collaborator
Author
|
Fix temporario, vou subir uma PR no mktplace pra parar de enviar a key na criação da kb, que era o jeito que o mindsdb aceitava |
magroski
approved these changes
Jul 7, 2026
|
Tick the box to add this pull request to the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Knowledge bases persist the OpenAI/Gemini API key at creation time in up to three places — the KB
paramsJSON (embedding_model/reranking_model), and, for ML-handler-backed embedding models, the model's own args. After we rotated all OpenAI keys, existing KBs kept using the stale stored key and failed with:The stored key shadows the environment variable because
get_api_keygives creation-time args priority over env vars.Change
Make the environment variable take precedence over any stored key on all KB key-resolution paths, so a rotated key can be updated in one place (the env) without recreating knowledge bases:
llm_client.py— embedding model prefers{PROVIDER}_API_KEY(gemini also honorsGOOGLE_API_KEY) before the storedapi_key.controller.py— reranking model uses the same env-first resolution; adds the missingimport os.openai_handler.py— adds_resolve_api_key()(env-first, keyed offapi_key_nameso provider subclasses stay correct) and routes the predict / describe / validate / finetune sites through it.Scoped to the KB + OpenAI-handler paths deliberately; the global
get_api_keyprecedence is left unchanged.Behavioral note
For OpenAI models, the env var now overrides even an inference-time
USING api_key='...'. Intended for a single-source-of-truth setup, but flagging it as a genuine precedence change on the OpenAI ML engine.Deploy
Requires
OPENAI_API_KEY(andGOOGLE_API_KEY) present in the container env. In the dev compose this is wired viaenv_file: ./mindsdb/.envon themindsdbservice (that compose lives outside this repo, so it's not part of this diff).Follow-up (discussed, not in this PR)
The more robust fix is to stop persisting the secret at creation and scrub existing rows (KB params, embedding-model args, and the
openaiML engine connection args), after which env becomes the sole source of truth and these env-first overrides can be removed.🤖 Generated with Claude Code