help request: How to dynamically pass parameters(sk-xxx) from Consumer to a ai-proxy plugin?

[ZZYhho]

Description

I am looking for a way to dynamically pass specific parameters configured at the Consumer level to a plugin executed within a Route.

Specifically, I have stored a credential (e.g., Bearer sk-xx) in the Consumer's configuration, and I need a downstream plugin in the matching route to access and use this value during the request lifecycle.

Environment

• APISIX version (run apisix version): 3.15
• Operating system (run uname -a):
• OpenResty / Nginx version (run openresty -V or nginx -V):
• etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
• APISIX Dashboard version, if relevant:
• Plugin runner version, for issues related to plugin runners:
• LuaRocks version, for installation issues (run luarocks --version):

[Baoyuantop]

Hi @ZZYhho, could you please describe your requirements in more detail? Do you mean you configure the AI ​api key in the Consumer, such as key-auth, and then need the ai-proxy plugin to automatically use that value to make AI model requests after the consumer successfully matches the data?

[ZZYhho]

@Baoyuantop Sorry,I will decribe it detail.

• To implement AI billing/accounting within our company, we have created multiple API Keys (SKs) at the provider side. Our goal is to store these keys at the Consumer level (using either labels or metadata) and pass them dynamically as variables to the ai-proxy plugin, which is configured on the Route side.

However, when I attempted to use labels to pass the credentials, the request failed with a 401 Unauthorized error. It seems the ai-proxy plugin is not correctly picking up the variable from the consumer context.

Q:

1. Does the ai-proxy plugin support reading credentials from Consumer labels or metadata via variables?
2. If this is not natively supported, what is the recommended workaround to achieve per-consumer SK injection for AI billing?

Current Configuration (Example)

Consumer:

{
    "username": "internal-team-a",
    "plugins": {
        "key-auth": {
            "key": "auth-key-for-team-a"
        }
    },
    "labels": {
        "provider_sk": "sk-xxxxxxxxxxxx"
    },
    "metadata": {
        "provider_sk": "sk-xxxxxxxxxxxx"
    }
}

Route:

{
    "uri": "/v1/chat/completions",
    "plugins": {
        "ai-proxy": {
            "auth": {
                "header": {
                    "Authorization": "$consumer_labels_provider_sk" 
                }
            },
            "model": {
                "provider": "openai",
                "name": "gpt-4"
            }
        }
    }
}

[Baoyuantop]

You can try configuring the ai-proxy plugin directly on each Consumer, with each Consumer setting its own auth.header.Authorization. This way, once a Consumer is authenticated, its ai-proxy configuration will override the Route's ai-proxy configuration, automatically using the corresponding SK.

[ZZYhho]

• We are integrating APISIX with multiple AI development tools like Codex and Claude Code. Due to differences in how these tools handle request structures and headers, we cannot use a single unified configuration for all of them.
• The Problem:is Configuration Explosion, Currently, if we have 10 users (each with a unique API Key) and 2 different tools, we end up having to maintain 20 separate Consumer/Route combinations. This is becoming an operational nightmare.

Current Tool Configurations
Codex Configuration:

// Consumer
{
  "username": "test-user1",
  "plugins": {
    "ai-proxy": {
      "auth": {
        "header": {
          "Authorization": "Bearer sk-user1"
        }
      },
      "override": {
        "endpoint": "https://openrouter.ai/api/v1/responses"
      },
      "provider": "openai"
    },
    "key-auth": {
      "key": "test-user1-codex-key"
    }
  }
}

// Route 
{
  "uri": "/api/v1/responses",
  "name": "codex",
  "methods": [
    "POST"
  ],
  "host": "apisix-test.com",
  "plugins": {
    "key-auth": {},
    "serverless-pre-function": {
      "functions": [
        "return function(conf, ctx) local h = require('apisix.core').request.header(ctx, 'Authorization'); if h then local t = h:match('Bearer%s+(.+)'); if t then require('apisix.core').request.set_header(ctx, 'apikey', t) end end end"
      ],
      "phase": "rewrite"
    }
  },
  "status": 1
}

Claude Code Configuration:

// Consumer
{
  "username": "test-user1",
  "plugins": {
    "ai-proxy": {
      "auth": {
        "header": {
          "Authorization": "Bearer sk-user1"
        }
      },
      },
      "override": {
        "endpoint": "https://openrouter.ai/api/v1/messages"
      },
      "provider": "openai-compatible",
    },
    "key-auth": {
      "key": "test-user1-cc-key"
    }
  }
}
// Route 
{
  "uri": "/v1/messages",
  "name": "cc",
  "host": "apisix-test.com",
  "plugins": {
    "key-auth": {
      "header": "x-api-key",
      "hide_credentials": true,
      "query": "apikey"
    }
  },
  "status": 1
}

I would be deeply grateful if you could help me merge my configurations or guide me on how to implement dynamic parameter passing correctly.

[Baoyuantop]

Hi @ZZYhho, if the auth.header configuration variable in the ai-proxy plugin seems to resolve the issue, you can simply set the consumer key to the AI service's key and then configure $consumer_key directly in the ai-proxy plugin.