Admin interface uses personal API_KEY for model selection

[AssassinTee]

Which version of assistant are you using?

2.13.0

Which version of Nextcloud are you using?

32.0.6

Which browser are you using? In case you are using the phone App, specify the Android or iOS version and device please.

Firefox

Describe the Bug

I get error messages of being unauthorized with a valid api key. I can send valid requests with the same key like this:

curl --header "Authorization: Bearer MY_API_KEY" https://api.example.com/v1/models

{"object":"list","data":[{"id":"0 - Ministral-3-14B-Instruct-2512 - The latest Ministral from Dec.2.2025" ...

(redacted infos)

I have a feeling, that the length (60 to 128 chars) OR a . being present inside the API key is causing this, but at this point I have no idea.

Protocol message:

{"reqId":"Ia7cxGGdSei1dhF2NcF6","level":2,"time":"2026-02-24T09:03:15+00:00","remoteAddr":"REDACTED","user":"REDACTED","app":"integration_openai","method":"GET","url":"/apps/integration_openai/models","scriptName":"/index.php","message":"Error retrieving models (exc): API request error: Invalid API Key/Basic Auth: Client error: `GET https://api.example.com/v1/models` resulted in a `401 Unauthorized` response:\nYou must provide a valid API key. Obtain one from REDACTED_THIRD_PARTY\n\n","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0","version":"32.0.6.1","data":{"app":"integration_openai"},"id":"699d6acc9f4e1"}

Expected Behavior

I expect this to just work

To Reproduce

Create a really long API key containing dots and try if it continues to work. I don't know if this is the core issue here

[AssassinTee]

Is there a way to double check the configured API key with a config:get or config:set command?

[janepie]

Sure!
occ config:app:get integration_openai api_key for retrieving
occ config:app:set --value=VALUE integration_openai api_key --sensitive for setting
(these are for admin-config values, I assume you are using these?)
Can you share which kind of provider you are using here?

[janepie]

I just checked, I have a dot in my own key so that should not be an issue

[AssassinTee]

Thank you for the provided commands! This actually helps me a lot to debug this.

The API key seems to be configured properly, however I still get 401 from the endpoint while the curl command is working 🤔 I wonder if there is a caching issue somewhere, because we are running the high-performance backend with the specialized daemon ai runners. I checked if the api key is configured for them anywhere else, which it isn't, so they must fetch it from the nextcloud somehow.

I'll now setup a test/fake LocalAI server and let the assistant run against it, so I can see which API key it sends

[AssassinTee]

I found the issue - If you are admin - but have a personal API token defined - the admin interface uses the personal token instead of the global one.

After deleting my personal API token (which deprecated), everything was working again

[AssassinTee]

I believe this might be an openai_integration issue instead, but I don't know

[janepie]

Yeah, that part is in integration_openai, but it is intended. We want the admin of an instance to be able to set a key every user can use, but leave it to the user to override it as they have their own key with more tokens for example. Gonna close this then, happy to hear it works now!

[AssassinTee]

Yeah, that part is in integration_openai, but it is intended. We want the admin of an instance to be able to set a key every user can use, but leave it to the user to override it as they have their own key with more tokens for example. Gonna close this then, happy to hear it works now!

Yes, but I'd expect the admin interface - the admin settings page - as an admin to use they key that is configured at the same page instead of my user key.

I don't know how this is not a bug, this is really obscure behavior

[janepie]

Ah you mean for getting the models? You're right, there the admin key should be used, good point! Gonna reopen and move