Code Interpreter API broken — x-api-key no longer sent after JWT minting refactor (#13028)

[DeeDrop]

What happened?

Hi,

I'm a paying Code Interpreter API subscriber and ran into a regression on the latest main branch where code execution no longer works with the documented LIBRECHAT_CODE_API_KEY setup.

Commit that introduced the issue: c67e2b54dca133a8faf3d37f1e54ee993e6bf153 (PR #13028, "🔐 feat: Mint Code API Auth Tokens", May 9, 2026)

What's happening:

After pulling main, code execution requests fail with:

CodeAPI request failed: POST https://api.librechat.ai/v1/exec returned 401, body: {"error":"API key is required"}

Root cause:

The new getCodeApiAuthHeaders() in packages/api/src/auth/codeapi.ts returns {} when JWT auth isn't enabled:

export async function getCodeApiAuthHeaders(req?: ServerRequest): Promise<Record<string, string>> {
  if (!req || !isCodeApiJwtAuthEnabled()) {
    return {};
  }
  ...
}

All the call sites (crud.js, process.js, ToolService.js, handleTools.js) were switched to use only these headers, so the previous x-api-key header from LIBRECHAT_CODE_API_KEY is no longer being sent anywhere.

Setting CODEAPI_AUTH_PROVIDER=legacy-api-key doesn't help either — isCodeApiJwtAuthEnabled() returns false in that case, so the function still returns empty headers.

Expected behavior:

Per the official docs (https://www.librechat.ai/docs/features/code_interpreter), the documented setup is to set LIBRECHAT_CODE_API_KEY in .env and the request should include the x-api-key header. Subscription users like me rely on this working out of the box.

Suggested fix:

In getCodeApiAuthHeaders(), fall back to { 'x-api-key': process.env.LIBRECHAT_CODE_API_KEY } when JWT auth isn't enabled and LIBRECHAT_CODE_API_KEY is set. This preserves backwards compatibility for subscription users while still supporting the new JWT auth for Enterprise self-hosted instances.

Happy to test a fix or open a PR if useful.

Thanks for all the work on LibreChat!

Version Information

$ docker images | grep librechat
librechat latest 28dad5f0fa3a 2026-05-13 12:50:08 +0000 UTC
registry.librechat.ai/danny-avila/librechat-rag-api-dev-lite latest 31122c5f83ea 2026-04-24 04:45:28 +0000 UTC
ghcr.io/clickhouse/librechat-admin-panel latest 9542874536e7 2026-04-17 17:43:08 +0000 UTC

Steps to Reproduce

1. Set up LibreChat from the latest main branch (any commit including c67e2b5 or later, merged May 9, 2026).
2. In .env, set your paid Code Interpreter API subscription key as documented:
   LIBRECHAT_CODE_API_KEY=sk-lc-code01_xxxxxxxxxxxxxxxxxxx
3. Build and start LibreChat (docker compose build && docker compose up -d).
4. Log in as any user.
5. In the chat, write any code block and click "Run Code", e.g.:

   print("hello world")

6. Observe the error:
   "CodeAPI request failed: POST https://api.librechat.ai/v1/exec returned 401, body: {"error":"API key is required"}"

Expected: code executes successfully using the API key from .env as documented at https://www.librechat.ai/docs/features/code_interpreter

Actual: 401 because the x-api-key header is no longer being sent — the new getCodeApiAuthHeaders() returns {} unless JWT auth is configured (which requires keys not available to subscription users).

Verified by reverting to a commit before c67e2b5 (e.g., v0.8.5 tag) — code execution works again with the same .env.

What browsers are you seeing the problem on?

Chrome

Relevant log output

error-2026-05-13.log:

{"level":"error","message":"[ON_TOOL_EXECUTE] Tool bash_tool error: Execution error:\n\nCodeAPI request failed: POST https://api.librechat.ai/v1/exec returned 401, body: {\"error\":\"API key is required\"}","stack":"Error: Execution error:\n\nCodeAPI request failed: POST https://api.librechat.ai/v1/exec returned 401, body: {\"error\":\"API key is required\"}\n    at tools.tool.name (/app/node_modules/@librechat/agents/dist/cjs/tools/BashExecutor.cjs:159:19)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async /app/node_modules/@langchain/core/dist/tools/index.cjs:307:22","timestamp":"2026-05-13T13:13:23.787Z"}

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

This is a planned deprecation, I'm working on releasing the open-source version of this soon.

#12902