Verified live: Authorization: Bearer <key> (what every OpenAI-SDK-compatible
client sends, pi included) gets 401 from this Kong key-auth config. A raw
apikey: <key> header succeeds. No such client lets you send a raw apikey
header or customize the auth header name, so key-auth here was blocking
100% of real usage, not just an edge case.
Comments out the model-key-auth KongPlugin and strips it from every route's
konghq.com/plugins annotation in llm-routes.yaml. KongConsumer/secret stay
defined so re-enabling later is cheap. Needs a real fix before going back on
(e.g. a request-transformer that copies the Bearer token into an apikey
header before key-auth runs) -- until then the model routes are
unauthenticated.
Story Crater Bot
3e4af746b0