Harden OpenAI key handling and stop echoing keys in chat errors.

Strip whitespace/quotes from OPENAI_API_KEY and map 401 invalid_api_key to a safe client message so Space secret misconfiguration is clearer without leaking key material.

Co-authored-by: Cursor <cursoragent@cursor.com>

multi_llm_chatbot_backend/app/api/routes/chat.py

@@ -14,6 +14,7 @@ from app.api.utils import get_or_create_session_for_request_async, load_chat_ses
 from app.core.auth import get_current_active_user
 from app.core.bootstrap import chat_orchestrator
 from app.core.database import get_database
+from app.core.secrets import client_safe_error_message
 from app.core.session_manager import get_session_manager
 from app.models.user import User
 from app.api.routes.user_profile import (
@@ -215,10 +216,11 @@ async def chat_stream(
                 except Exception as e:
                     logger.exception(f"chat-stream _run failed for {pid}: {e}")
                     failed_persona = chat_orchestrator.get_persona(pid)
+                    safe = client_safe_error_message(e)
                     await done_queue.put({
                         "persona_id": pid,
                         "persona_name": failed_persona.name if failed_persona else pid,
-                        "response": f"I ran into a technical issue. Please try again. ({e!s})",
+                        "response": f"I ran into a technical issue. Please try again. ({safe})",
                         "used_documents": False,
                         "document_chunks_used": 0,
                     })
@@ -251,7 +253,7 @@ async def chat_stream(
             logger.error(traceback.format_exc())
             yield ChatStreamLine(
                 type="error",
-                data={"detail": str(exc)},
+                data={"detail": client_safe_error_message(exc)},
             ).to_ndjson()
 
     return StreamingResponse(

multi_llm_chatbot_backend/app/api/routes/root.py

@@ -1,8 +1,10 @@
 from fastapi import APIRouter
 from app.config import get_settings
+from app.core.secrets import normalize_secret
 from app.version import __version__
 
 import logging
+import os
 
 logger = logging.getLogger(__name__)
 
@@ -14,10 +16,17 @@ router = APIRouter()
 # leave users staring at this JSON banner instead of the app.
 @router.get("/api/health")
 def root():
-    title = get_settings().app.title
+    settings = get_settings()
+    title = settings.app.title
+    openai_key_configured = bool(
+        normalize_secret(settings.llm.openai.api_key)
+        or normalize_secret(os.getenv("OPENAI_API_KEY", ""))
+    )
     return {
         "message": f"{title} Backend is up and running",
         "version": __version__,
+        "llm_provider": settings.llm.provider,
+        "openai_api_key_configured": openai_key_configured,
         "features": [
             "Configurable Personas",
             "Improved Session Management",
@@ -27,4 +36,3 @@ def root():
             "Provider Switching"
         ]
     }
-

multi_llm_chatbot_backend/app/core/bootstrap.py

@@ -3,6 +3,7 @@ import os
 from pathlib import Path
 
 from app.core.env_loader import load_application_env
+from app.core.secrets import normalize_secret
 
 load_application_env()
 
@@ -32,7 +33,7 @@ def _load_shared_env_var(name: str) -> str:
         for line in shared.read_text(encoding="utf-8").splitlines():
             line = line.strip()
             if line.startswith(prefix):
-                return line.split("=", 1)[1].strip()
+                return normalize_secret(line.split("=", 1)[1])
     return ""
 
 
@@ -73,7 +74,7 @@ def _vllm_api_key() -> str:
 
 
 def _openai_api_key() -> str:
-    return (
+    return normalize_secret(
         settings.llm.openai.api_key
         or os.getenv("OPENAI_API_KEY", "")
         or _load_shared_env_var("OPENAI_API_KEY")

multi_llm_chatbot_backend/app/core/secrets.py

@@ -0,0 +1,40 @@
+"""Helpers for loading secrets and redacting them from client-facing errors."""
+
+from __future__ import annotations
+
+import re
+
+_SK_RE = re.compile(r"sk-(?:proj-)?[A-Za-z0-9_\-]{6,}")
+
+
+def normalize_secret(value: str | None) -> str:
+    """Strip whitespace and accidental surrounding quotes from a secret value.
+
+    Hugging Face Space secret pastes sometimes include trailing newlines or
+    wrapping quotes; either produces an otherwise-valid-looking key that
+    OpenAI rejects with 401 invalid_api_key.
+    """
+    text = (value or "").strip()
+    if len(text) >= 2 and text[0] == text[-1] and text[0] in ("'", '"'):
+        text = text[1:-1].strip()
+    return text
+
+
+def client_safe_error_message(exc: BaseException) -> str:
+    """Return an error string safe to show end users (no API key material)."""
+    text = str(exc)
+    lowered = text.lower()
+    if "invalid_api_key" in lowered or "incorrect api key" in lowered:
+        return (
+            "OpenAI rejected the API key. Update the OPENAI_API_KEY secret under "
+            "Hugging Face Space Settings → Variables and secrets, then restart "
+            "the Space."
+        )
+    if "authenticationerror" in type(exc).__name__.lower() or (
+        "401" in text and "api" in lowered
+    ):
+        return (
+            "OpenAI authentication failed. Check that OPENAI_API_KEY is set "
+            "correctly in Space secrets and that the key is still valid."
+        )
+    return _SK_RE.sub("sk-***", text)

multi_llm_chatbot_backend/app/llm/openai_fallback_client.py

@@ -6,10 +6,11 @@ import json
 import logging
 from typing import Any, Callable, Dict, List, Optional
 
-from openai import AsyncOpenAI, APIConnectionError, APIStatusError
+from openai import AsyncOpenAI, APIConnectionError, APIStatusError, AuthenticationError
 
 from app.llm.llm_client import LLMClient, ToolCallInfo, ToolCallResult
 from app.core.context_manager import get_context_manager
+from app.core.secrets import client_safe_error_message, normalize_secret
 
 logger = logging.getLogger(__name__)
 
@@ -27,6 +28,7 @@ class OpenAIFallbackClient(LLMClient):
         model: str = "gpt-5.4",
         reasoning_effort: Optional[str] = None,
     ):
+        api_key = normalize_secret(api_key)
         if not api_key:
             raise ValueError("OpenAI API key not set. Provide OPENAI_API_KEY or llm.openai.api_key.")
         self.model = model
@@ -34,6 +36,11 @@ class OpenAIFallbackClient(LLMClient):
         self.client = AsyncOpenAI(api_key=api_key, timeout=120.0)
         self.context_manager = get_context_manager()
 
+    @staticmethod
+    def _auth_failure(exc: AuthenticationError) -> RuntimeError:
+        logger.error("OpenAI authentication failed (invalid or missing API key)")
+        return RuntimeError(client_safe_error_message(exc))
+
     _ALLOWED_ROLES = {"system", "assistant", "user", "function", "tool", "developer"}
 
     def _reasoning_kwargs(self, *, with_tools: bool = False) -> Dict[str, Any]:
@@ -100,11 +107,13 @@ class OpenAIFallbackClient(LLMClient):
             if not text:
                 raise ValueError("OpenAI returned empty content")
             return self._clean_response(text)
+        except AuthenticationError as exc:
+            raise self._auth_failure(exc) from None
         except (APIConnectionError, APIStatusError) as exc:
-            logger.error("OpenAI API error: %s", exc)
+            logger.error("OpenAI API error: %s", client_safe_error_message(exc))
             raise
         except Exception as exc:
-            logger.error("OpenAI generate failed: %s", exc)
+            logger.error("OpenAI generate failed: %s", client_safe_error_message(exc))
             raise
 
     _MAX_TOOL_ROUNDS = 5
@@ -168,9 +177,11 @@ class OpenAIFallbackClient(LLMClient):
                     })
 
             raise ValueError("OpenAI tool-calling loop exhausted max rounds")
+        except AuthenticationError as exc:
+            raise self._auth_failure(exc) from None
         except (APIConnectionError, APIStatusError) as exc:
-            logger.error("OpenAI tool API error: %s", exc)
+            logger.error("OpenAI tool API error: %s", client_safe_error_message(exc))
             raise
         except Exception as exc:
-            logger.error("OpenAI generate_with_tools failed: %s", exc)
+            logger.error("OpenAI generate_with_tools failed: %s", client_safe_error_message(exc))
             raise

multi_llm_chatbot_backend/app/tests/unit/test_secrets.py

@@ -0,0 +1,39 @@
+"""Unit tests for secret normalization and client-safe error messages."""
+
+import unittest
+
+from app.core.secrets import client_safe_error_message, normalize_secret
+
+
+class NormalizeSecretTests(unittest.TestCase):
+    def test_strips_whitespace(self):
+        self.assertEqual(normalize_secret("  sk-abc  \n"), "sk-abc")
+
+    def test_strips_wrapping_quotes(self):
+        self.assertEqual(normalize_secret('"sk-abc"'), "sk-abc")
+        self.assertEqual(normalize_secret("'sk-abc'"), "sk-abc")
+
+    def test_empty(self):
+        self.assertEqual(normalize_secret(None), "")
+        self.assertEqual(normalize_secret(""), "")
+
+
+class ClientSafeErrorMessageTests(unittest.TestCase):
+    def test_redacts_api_key_material(self):
+        raw = (
+            "Error code: 401 - {'error': {'message': "
+            "'Incorrect API key provided: sk-proj-ABCDEFGHIJKLMNOP. "
+            "You can find your API key at https://platform.openai.com/account/api-keys.', "
+            "'type': 'invalid_request_error', 'code': 'invalid_api_key'}}"
+        )
+        safe = client_safe_error_message(Exception(raw))
+        self.assertNotIn("sk-proj-ABCDEF", safe)
+        self.assertIn("OPENAI_API_KEY", safe)
+
+    def test_passes_through_unrelated_errors(self):
+        msg = "Connection timed out talking to upstream"
+        self.assertEqual(client_safe_error_message(Exception(msg)), msg)
+
+
+if __name__ == "__main__":
+    unittest.main()