# 3.6 — Migrate pi to Bearer and one provider (REFACTOR)

Phase: 3 — Authentication
Stage: REFACTOR
Depends on: [2.2](2.2-body-based-dispatch.md), [3.3](3.3-authentik-service-account.md), [3.4](3.4-flag-gated-rollout.md)

- [ ] `~/.pi/agent/models.json` no longer contains a `customHeaders: {apikey: ...}` block anywhere
- [ ] pi authenticates with `Authorization: Bearer` carrying an Authentik-issued token
- [ ] The three provider entries `homelab-reasoning`, `homelab-ornith` and `homelab-qwen` collapse into ONE provider entry
- [ ] That single provider's base URL is the canonical OpenAI base, and the three models are listed under it — body-based dispatch makes per-model base URLs unnecessary
- [ ] pi reaches all three models through `POST /v1/chat/completions` with `model` set to `reasoning`, `ornith:35b`, and `qwen2.5:3b-instruct`
- [ ] Streaming still works from pi, and interrupting a generation cancels it upstream rather than leaving it running
- [ ] The old config is captured before editing, so a revert is one file restore
- [ ] Verified with auth ON, because that is the state the migration exists to survive

The `apikey` header exists only because Kong OSS `key-auth` rejected
`Authorization: Bearer`. Once this lands, nothing depends on the legacy aliases in
[2.4](2.4-legacy-path-aliases.md) and they can be removed.

## Verify

```bash
grep -c apikey ~/.pi/agent/models.json     # expected: 0
grep -c '"homelab' ~/.pi/agent/models.json # expected: 1 provider entry, not 3

for m in reasoning ornith:35b qwen2.5:3b-instruct; do
  curl -s -o /dev/null -w "$m %{http_code}\n" https://api.riotpiao.com/v1/chat/completions \
    -H "authorization: Bearer $ACCESS_TOKEN" -H 'content-type: application/json' \
    -d "{\"model\":\"$m\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}"
done
# expected: 200 for all three, with auth enabled

curl -N -s https://api.riotpiao.com/v1/chat/completions -H "authorization: Bearer $ACCESS_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"model":"reasoning","stream":true,"messages":[{"role":"user","content":"hi"}]}'
# expected: text/event-stream chunks arriving incrementally; reasoning_content and content both present
```