first commit

kong/key-auth.yaml

@@ -0,0 +1,21 @@
+# For callers that can't do OIDC on their outbound LLM connection (e.g.
+# LibreChat's custom endpoints only support a static apiKey — no
+# OAuth/OIDC block, see packages/data-provider/src/config.ts,
+# endpointSchema). Proves "the caller is this app", not which end user is
+# asking. Coexists with openid-connect on the same route — Kong accepts if
+# either auth plugin succeeds.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-llm-key-auth
+  namespace: ${NAMESPACE}
+plugin: key-auth
+config:
+  key_names:
+    - apikey
+  hide_credentials: true
+  key_in_query: false
+  key_in_body: false
+  # See openid-connect.yaml's comment — same "OR" auth mechanism, same
+  # anonymous consumer, both plugins must have this set or neither.
+  anonymous: ${LLM_ANONYMOUS_CONSUMER_ID}