Refactor API key header conventions for client-facing standards

[Thenujan-Nagaratnam]

This pull request standardizes the API key authentication headers and conventions across all gateway provider and proxy example YAML files, aligning each with the conventions used by their respective upstream vendors. It also updates the frontend code to default to vendor-specific header conventions and improves how security configurations are handled. These changes ensure better compatibility and clarity when integrating with different LLM providers.

API Key Header Standardization and Convention Alignment:

• Changed API key header names in provider and proxy YAML files to match each upstream vendor’s convention (e.g., Authorization with Bearer for OpenAI, Mistral, Bedrock; x-api-key for Anthropic; x-goog-api-key for Gemini; api-key for Azure OpenAI). Also updated documentation comments to clarify these conventions.

Frontend and Utility Code Improvements:

• Updated the frontend (ServiceProviderNew.tsx) to default the client-facing API key header to the convention used by the selected upstream vendor, improving user experience and reducing misconfiguration.
• Improved the provider request utility (tmpSPRequest.ts) to honor a pre-resolved security configuration from the caller, only falling back to a generic default if none is supplied.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 083f05fa-b404-49bf-b74e-c6945b41a261

📥 Commits

Reviewing files that changed from the base of the PR and between 46b2bd6 and f1aa9b7.

📒 Files selected for processing (1)

• portals/ai-workspace/src/pages/appShell/appShellPages/serviceProvider/ServiceProviderNew.tsx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The gateway examples now use provider-specific authentication headers and bearer prefixes. The AI workspace preserves these security settings when it creates providers.

Changes

Provider authentication alignment

Layer / File(s)	Summary
Provider policy authentication gateway/examples/*-provider.yaml	Provider policies now use x-api-key, api-key, x-goog-api-key, or Authorization: Bearer according to each upstream provider.
Proxy authentication examples gateway/examples/*-proxy.yaml, gateway/examples/openai-multi-provider-proxy.yaml	Proxy examples configure provider-specific headers and bearer values. Client authentication documentation now uses bearer authorization.
Workspace security propagation portals/ai-workspace/src/pages/appShell/appShellPages/serviceProvider/ServiceProviderNew.tsx, portals/ai-workspace/src/utils/tmpSPRequest.ts	Provider creation derives the client header and value prefix from upstream authentication settings and preserves supplied security configuration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to f1aa9

The PR standardizes provider-specific API key headers and frontend defaults without any supplied evidence of an actionable merge-blocking risk; it is merge-ready after normal checks and review.

Possibly related PRs

• wso2/api-platform#3228: Related to LLM provider and proxy API-key security configuration, but it changes validation logic rather than authentication mapping.

Suggested reviewers: krishanx92, lasanthas, pubudu538

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the main changes but omits most required template sections, including purpose links, tests, security checks, documentation, samples, and test environment.	Add the required template sections and provide issue links, testing details, security confirmations, documentation impact, sample details, related PRs, and test environment information.
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: standardizing API key header conventions for client-facing integrations.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}