pass api key to workflow

[roman-van-der-krogt]

Pass the API token to the upstream temporal worker for calling the internal APIs with.

Summary by CodeRabbit

• Bug Fixes

  • Workflow runs now fall back to the configured Temporal API key when no gateway token is provided, ensuring tokens are included in workflow memos when available; header handling and error behavior remain unchanged. No public API changes.

• Style

  • Minor formatting cleanup with no behavioral impact.

[coderabbitai]

Walkthrough

Adds a gateway_token fallback to app.config.temporal.api_key in the _workflow_run path of the app server. Separately, a formatting-only blank line was inserted in a Temporal system activities file. No public API signatures changed.

Changes

Cohort / File(s)	Summary
App server token fallback src/mcp_agent/server/app_server.py	In _workflow_run, gateway_token is now set from kwargs.get("gateway_token") or app.config.temporal.api_key as a guarded fallback; surrounding logic and error handling remain unchanged.
Temporal system activities formatting src/mcp_agent/executor/temporal/system_activities.py	Formatting-only: added a blank line after gateway_token initialization in relay_notify; no logic, control flow, or API changes.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant C as Caller
  participant S as App Server (_workflow_run)
  participant CFG as App Config
  participant T as Temporal Workflow

  C->>S: Invoke _workflow_run(kwargs)
  alt gateway_token provided
    S->>S: gateway_token = kwargs["gateway_token"]
  else no token provided
    S->>CFG: Read temporal.api_key
    CFG-->>S: api_key (or None)
    S->>S: gateway_token = api_key (if available)
  end
  S->>T: Start workflow with workflow_memo(gateway_token)
  T-->>S: Ack/Result
  S-->>C: Response

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Fix gateway URL resolution #443 — Also modifies gateway_token sourcing in app_server._workflow_run, related to token/memo precedence and extraction.

Suggested reviewers

• rholinshead

Pre-merge checks (2 passed, 1 warning)

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The PR title "pass api key to workflow" succinctly and accurately summarizes the primary change—propagating the API/gateway token into the Temporal workflow (as reflected in app_server.py) — so it is relevant, concise, and matches the PR objectives.

Poem

A token hops where none was found,
From config burrow, safe and sound.
The workflow hums, the queues align—
A hare’s small tweak, now running fine.
Tip-tap keys, then off I bound—
To fields of green, with stable ground. 🐇✨

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 57366d3 and fe3bf14.

📒 Files selected for processing (1)

• src/mcp_agent/server/app_server.py (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• src/mcp_agent/server/app_server.py

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: checks / test

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/pass-api-key

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/mcp_agent/server/app_server.py (1)

1401-1420: Fix token precedence regression and avoid aborting memo inference when app is None.

Using or app.config.temporal.api_key here changes precedence (headers/env no longer override) and can raise if app is None, causing the whole memo inference block to fall back to workflow_memo = None. Use app_context.config.temporal.api_key as a last-resort fallback after kwargs/headers/env, and treat empty strings as “not set.”

Apply:

-            gateway_url = kwargs.get("gateway_url")
-            gateway_token = kwargs.get("gateway_token") or app.config.temporal.api_key
+            gateway_url = kwargs.get("gateway_url")
+            # Start with explicit kwarg only; other sources will fill if missing.
+            gateway_token = kwargs.get("gateway_token")
@@
-                # Token may be provided by the gateway/proxy
-                if gateway_token is None:
+                # Token may be provided by the gateway/proxy
+                if not gateway_token:
                     gateway_token = h.get("X-MCP-Gateway-Token")
-                if gateway_token is None:
+                if not gateway_token:
                     # Support Authorization: Bearer <token>
                     auth = h.get("Authorization")
                     if auth and auth.lower().startswith("bearer "):
                         gateway_token = auth.split(" ", 1)[1]
@@
-                if gateway_token is None:
+                if not gateway_token:
                     env_tok = _os.environ.get("MCP_GATEWAY_TOKEN")
                     if env_tok:
                         gateway_token = env_tok
+            # Final fallback: app config (Temporal API key)
+            if not gateway_token:
+                try:
+                    gateway_token = app_context.config.temporal.api_key
+                except Exception:
+                    pass

🧹 Nitpick comments (1)

src/mcp_agent/server/app_server.py (1)

1456-1461: Verify risk of putting raw credentials in Temporal memo.

Memos are commonly visible via Temporal Web/API. Confirm this is acceptable for your threat model; otherwise prefer a short-lived, per-run token, server-side credential lookups in the worker, or encryption/opaque references rather than a plaintext API key.

Would you like a follow-up patch to switch to a per-run signed token and redact tokens from any potential logs?

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between af373a2 and 57366d3.

📒 Files selected for processing (2)

• src/mcp_agent/executor/temporal/system_activities.py (1 hunks)
• src/mcp_agent/server/app_server.py (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

src/mcp_agent/server/app_server.py (1)

src/mcp_agent/app.py (1)

• config (155-156)

🔇 Additional comments (1)

src/mcp_agent/executor/temporal/system_activities.py (1)

66-70: No-op formatting change looks fine.

No behavioral impact. Safe to merge.