From 7f83a627ee3792295418d63f6c9cb1fa57f42e9e Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Sat, 18 Apr 2026 04:32:23 -0400 Subject: [PATCH] fix(llm): send Gemini API key via x-goog-api-key header API keys in query strings leak to access logs, proxies, and request traces. Move to the header form Google documents as equivalent for both generateContent and streamGenerateContent endpoints. --- lib/crates/fabro-llm/src/providers/gemini.rs | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/lib/crates/fabro-llm/src/providers/gemini.rs b/lib/crates/fabro-llm/src/providers/gemini.rs index e66d81f2c..03020c129 100644 --- a/lib/crates/fabro-llm/src/providers/gemini.rs +++ b/lib/crates/fabro-llm/src/providers/gemini.rs @@ -898,11 +898,15 @@ impl ProviderAdapter for Adapter { let api_body = build_api_request(request); let url = format!( - "{}/models/{}:generateContent?key={}", - self.http.base_url, request.model, self.http.api_key + "{}/models/{}:generateContent", + self.http.base_url, request.model ); - let mut req = self.http.client.post(&url); + let mut req = self + .http + .client + .post(&url) + .header("x-goog-api-key", &self.http.api_key); for (key, value) in &self.http.default_headers { req = req.header(key, value); } @@ -964,11 +968,15 @@ impl ProviderAdapter for Adapter { let api_body = build_api_request(request); let url = format!( - "{}/models/{}:streamGenerateContent?alt=sse&key={}", - self.http.base_url, request.model, self.http.api_key + "{}/models/{}:streamGenerateContent?alt=sse", + self.http.base_url, request.model ); - let mut req = self.http.client.post(&url); + let mut req = self + .http + .client + .post(&url) + .header("x-goog-api-key", &self.http.api_key); for (key, value) in &self.http.default_headers { req = req.header(key, value); }