# For callers that can't do OIDC on their outbound LLM connection (e.g.
# LibreChat's custom endpoints only support a static apiKey — no
# OAuth/OIDC block, see packages/data-provider/src/config.ts,
# endpointSchema). Proves "the caller is this app", not which end user is
# asking. Coexists with openid-connect on the same route — Kong accepts if
# either auth plugin succeeds.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-llm-key-auth
  namespace: ${NAMESPACE}
plugin: key-auth
config:
  key_names:
    - apikey
  hide_credentials: true
  key_in_query: false
  key_in_body: false
  # See openid-connect.yaml's comment — same "OR" auth mechanism, same
  # anonymous consumer, both plugins must have this set or neither.
  anonymous: ${LLM_ANONYMOUS_CONSUMER_ID}