Repository navigation
[awf] api-proxy: Gemini API key not injected — agent bypasses proxy on port 10003 #2704
Description
Problem
Gemini engine runs fail with 400 API_KEY_INVALID from generativelanguage.googleapis.com despite a valid key. Squid logs confirm requests originate from the agent container (172.30.0.20) directly, not from the api-proxy (172.30.0.30), meaning key injection never happens.
Context
Upstream: github/gh-aw#29417
- gh-aw v0.71.3, AWF firewall image 0.25.29
GEMINI_API_BASE_URLenv var appears to not point to the api-proxy sidecar
Root Cause
The agent container's GEMINI_API_BASE_URL is not being set to (172.30.0.30/redacted) when --enable-api-proxyis active. The Gemini SDK then hitsgenerativelanguage.googleapis.com` directly (no key injected) and is rejected.
Proposed Solution
- In
src/docker-manager.ts, ensureGEMINI_API_BASE_URL=(172.30.0.30/redacted) is set in the agent container environment when--enable-api-proxyis enabled (mirroring howANTHROPIC_BASE_URLandOPENAI_BASE_URL` are handled). - Verify
containers/api-proxy/correctly handles Gemini API requests on port 10003 and injectsGEMINI_API_KEY. - Add a Squid log assertion test verifying requests originate from
172.30.0.30when api-proxy is enabled.
Generated by Firewall Issue Dispatcher · ● 1.2M · ◷
Activity
github-actions commentedon May 7, 2026
👋 Hello! I noticed this issue might be related to existing issues:
GEMINI_API_BASE_URLnot routing through the sidecarAPI_KEY_INVALIDerror fromgenerativelanguage.googleapis.comIf one of these already addresses the root cause (or was previously fixed and regressed), please consider linking or closing as a duplicate. Otherwise, feel free to clarify how this instance differs!
This is an automated message from the issue duplication detector.
lpcox commentedon May 8, 2026
Closing — already fixed in PR #2348 (commit 4e45e87). Gemini CLI is now routed through the api-proxy sidecar via
GOOGLE_GEMINI_BASE_URLon port 10003.