Introduce an ApiKey Abstraction to enable Dynamic ApiKeys

Some model providers use short-lived api keys which must be renewed at regular
intervals using another credential. For example, a GCP service account can be exchanged
for an api key to call Vertex AI.

A StaticApiKey implementation is provided for API providers that use long lived api
keys. OpenAiApi class was changed so that it accepts an ApiKey instead of a String
which caused a lot small changes in downstream integration tests and auto configurations
that were creating a OpenAiApi using a String key.

Model provider specific implementations of the ApiKey interface will be in a future
commit.

Author: asaikali

models/spring-ai-openai/src/main/java/org/springframework/ai/openai/api/OpenAiApi.java

@@ -25,6 +25,9 @@
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonInclude.Include;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import org.springframework.ai.chat.metadata.Usage;
+import org.springframework.ai.embedding.Embedding;
+import org.springframework.ai.model.security.ApiKey;
 import reactor.core.publisher.Flux;
 import reactor.core.publisher.Mono;
 
@@ -74,13 +77,15 @@ public class OpenAiApi {
 
 	private final WebClient webClient;
 
+	private final ApiKey apiKey;
+
 	private OpenAiStreamFunctionCallingHelper chunkMerger = new OpenAiStreamFunctionCallingHelper();
 
 	/**
 	 * Create a new chat completion api with base URL set to https://api.openai.com
 	 * @param apiKey OpenAI apiKey.
 	 */
-	public OpenAiApi(String apiKey) {
+	public OpenAiApi(ApiKey apiKey) {
 		this(OpenAiApiConstants.DEFAULT_BASE_URL, apiKey);
 	}
 
@@ -89,7 +94,7 @@ public OpenAiApi(String apiKey) {
 	 * @param baseUrl api base URL.
 	 * @param apiKey OpenAI apiKey.
 	 */
-	public OpenAiApi(String baseUrl, String apiKey) {
+	public OpenAiApi(String baseUrl, ApiKey apiKey) {
 		this(baseUrl, apiKey, RestClient.builder(), WebClient.builder());
 	}
 
@@ -100,7 +105,7 @@ public OpenAiApi(String baseUrl, String apiKey) {
 	 * @param restClientBuilder RestClient builder.
 	 * @param webClientBuilder WebClient builder.
 	 */
-	public OpenAiApi(String baseUrl, String apiKey, RestClient.Builder restClientBuilder,
+	public OpenAiApi(String baseUrl, ApiKey apiKey, RestClient.Builder restClientBuilder,
 			WebClient.Builder webClientBuilder) {
 		this(baseUrl, apiKey, restClientBuilder, webClientBuilder, RetryUtils.DEFAULT_RESPONSE_ERROR_HANDLER);
 	}
@@ -113,7 +118,7 @@ public OpenAiApi(String baseUrl, String apiKey, RestClient.Builder restClientBui
 	 * @param webClientBuilder WebClient builder.
 	 * @param responseErrorHandler Response error handler.
 	 */
-	public OpenAiApi(String baseUrl, String apiKey, RestClient.Builder restClientBuilder,
+	public OpenAiApi(String baseUrl, ApiKey apiKey, RestClient.Builder restClientBuilder,
 			WebClient.Builder webClientBuilder, ResponseErrorHandler responseErrorHandler) {
 		this(baseUrl, apiKey, "/v1/chat/completions", "/v1/embeddings", restClientBuilder, webClientBuilder,
 				responseErrorHandler);
@@ -129,7 +134,7 @@ public OpenAiApi(String baseUrl, String apiKey, RestClient.Builder restClientBui
 	 * @param webClientBuilder WebClient builder.
 	 * @param responseErrorHandler Response error handler.
 	 */
-	public OpenAiApi(String baseUrl, String apiKey, String completionsPath, String embeddingsPath,
+	public OpenAiApi(String baseUrl, ApiKey apiKey, String completionsPath, String embeddingsPath,
 			RestClient.Builder restClientBuilder, WebClient.Builder webClientBuilder,
 			ResponseErrorHandler responseErrorHandler) {
 
@@ -148,19 +153,19 @@ public OpenAiApi(String baseUrl, String apiKey, String completionsPath, String e
 	 * @param webClientBuilder WebClient builder.
 	 * @param responseErrorHandler Response error handler.
 	 */
-	public OpenAiApi(String baseUrl, String apiKey, MultiValueMap<String, String> headers, String completionsPath,
+	public OpenAiApi(String baseUrl, ApiKey apiKey, MultiValueMap<String, String> headers, String completionsPath,
 			String embeddingsPath, RestClient.Builder restClientBuilder, WebClient.Builder webClientBuilder,
 			ResponseErrorHandler responseErrorHandler) {
 
 		Assert.hasText(completionsPath, "Completions Path must not be null");
 		Assert.hasText(embeddingsPath, "Embeddings Path must not be null");
 		Assert.notNull(headers, "Headers must not be null");
 
+		this.apiKey = apiKey;
 		this.completionsPath = completionsPath;
 		this.embeddingsPath = embeddingsPath;
 		// @formatter:off
 		Consumer<HttpHeaders> finalHeaders = h -> {
-			h.setBearerAuth(apiKey);
 			h.setContentType(MediaType.APPLICATION_JSON);
 			h.addAll(headers);
 		};
@@ -207,12 +212,12 @@ public ResponseEntity<ChatCompletion> chatCompletionEntity(ChatCompletionRequest
 		Assert.isTrue(!chatRequest.stream(), "Request must set the stream property to false.");
 		Assert.notNull(additionalHttpHeader, "The additional HTTP headers can not be null.");
 
-		return this.restClient.post()
-			.uri(this.completionsPath)
-			.headers(headers -> headers.addAll(additionalHttpHeader))
-			.body(chatRequest)
-			.retrieve()
-			.toEntity(ChatCompletion.class);
+		return this.restClient.post().uri(this.completionsPath).headers(headers -> {
+			headers.addAll(additionalHttpHeader);
+			if (!additionalHttpHeader.containsKey(HttpHeaders.AUTHORIZATION)) {
+				headers.setBearerAuth(apiKey.getValue());
+			}
+		}).body(chatRequest).retrieve().toEntity(ChatCompletion.class);
 	}
 
 	/**
@@ -241,9 +246,12 @@ public Flux<ChatCompletionChunk> chatCompletionStream(ChatCompletionRequest chat
 
 		AtomicBoolean isInsideTool = new AtomicBoolean(false);
 
-		return this.webClient.post()
-			.uri(this.completionsPath)
-			.headers(headers -> headers.addAll(additionalHttpHeader))
+		return this.webClient.post().uri(this.completionsPath).headers(headers -> {
+			headers.addAll(additionalHttpHeader);
+			if (!additionalHttpHeader.containsKey(HttpHeaders.AUTHORIZATION)) {
+				headers.setBearerAuth(apiKey.getValue());
+			}
+		})
 			.body(Mono.just(chatRequest), ChatCompletionRequest.class)
 			.retrieve()
 			.bodyToFlux(String.class)
@@ -317,6 +325,7 @@ public <T> ResponseEntity<EmbeddingList<Embedding>> embeddings(EmbeddingRequest<
 
 		return this.restClient.post()
 			.uri(this.embeddingsPath)
+			.headers(headers -> headers.setBearerAuth(apiKey.getValue()))
 			.body(embeddingRequest)
 			.retrieve()
 			.toEntity(new ParameterizedTypeReference<>() {

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/ChatCompletionRequestTests.java

@@ -22,6 +22,7 @@
 
 import org.springframework.ai.chat.prompt.Prompt;
 import org.springframework.ai.model.function.FunctionCallbackWrapper;
+import org.springframework.ai.model.security.StaticApiKey;
 import org.springframework.ai.openai.api.OpenAiApi;
 import org.springframework.ai.openai.api.tool.MockWeatherService;
 
@@ -35,7 +36,7 @@ public class ChatCompletionRequestTests {
 	@Test
 	public void createRequestWithChatOptions() {
 
-		var client = new OpenAiChatModel(new OpenAiApi("TEST"),
+		var client = new OpenAiChatModel(new OpenAiApi(new StaticApiKey("TEST")),
 				OpenAiChatOptions.builder().withModel("DEFAULT_MODEL").withTemperature(66.6).build());
 
 		var request = client.createRequest(new Prompt("Test message content"), false);
@@ -61,7 +62,7 @@ public void promptOptionsTools() {
 
 		final String TOOL_FUNCTION_NAME = "CurrentWeather";
 
-		var client = new OpenAiChatModel(new OpenAiApi("TEST"),
+		var client = new OpenAiChatModel(new OpenAiApi(new StaticApiKey("TEST")),
 				OpenAiChatOptions.builder().withModel("DEFAULT_MODEL").build());
 
 		var request = client.createRequest(new Prompt("Test message content",
@@ -91,7 +92,7 @@ public void defaultOptionsTools() {
 
 		final String TOOL_FUNCTION_NAME = "CurrentWeather";
 
-		var client = new OpenAiChatModel(new OpenAiApi("TEST"),
+		var client = new OpenAiChatModel(new OpenAiApi(new StaticApiKey("TEST")),
 				OpenAiChatOptions.builder()
 					.withModel("DEFAULT_MODEL")
 					.withFunctionCallbacks(List.of(FunctionCallbackWrapper.builder(new MockWeatherService())

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/OpenAiTestConfiguration.java

@@ -16,6 +16,7 @@
 
 package org.springframework.ai.openai;
 
+import org.springframework.ai.model.security.StaticApiKey;
 import org.springframework.ai.openai.api.OpenAiApi;
 import org.springframework.ai.openai.api.OpenAiApi.ChatModel;
 import org.springframework.ai.openai.api.OpenAiAudioApi;
@@ -30,7 +31,7 @@ public class OpenAiTestConfiguration {
 
 	@Bean
 	public OpenAiApi openAiApi() {
-		return new OpenAiApi(getApiKey());
+		return new OpenAiApi(new StaticApiKey(getApiKey()));
 	}
 
 	@Bean

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/api/OpenAiApiIT.java

@@ -20,6 +20,7 @@
 
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
+import org.springframework.ai.model.security.StaticApiKey;
 import reactor.core.publisher.Flux;
 
 import org.springframework.ai.openai.api.OpenAiApi.ChatCompletion;
@@ -39,7 +40,7 @@
 @EnabledIfEnvironmentVariable(named = "OPENAI_API_KEY", matches = ".+")
 public class OpenAiApiIT {
 
-	OpenAiApi openAiApi = new OpenAiApi(System.getenv("OPENAI_API_KEY"));
+	OpenAiApi openAiApi = new OpenAiApi(new StaticApiKey(System.getenv("OPENAI_API_KEY")));
 
 	@Test
 	void chatCompletionEntity() {

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/api/tool/OpenAiApiToolFunctionCallIT.java

@@ -27,6 +27,7 @@
 import org.slf4j.LoggerFactory;
 
 import org.springframework.ai.model.ModelOptionsUtils;
+import org.springframework.ai.model.security.StaticApiKey;
 import org.springframework.ai.openai.api.OpenAiApi;
 import org.springframework.ai.openai.api.OpenAiApi.ChatCompletion;
 import org.springframework.ai.openai.api.OpenAiApi.ChatCompletionMessage;
@@ -52,7 +53,7 @@ public class OpenAiApiToolFunctionCallIT {
 
 	MockWeatherService weatherService = new MockWeatherService();
 
-	OpenAiApi completionApi = new OpenAiApi(System.getenv("OPENAI_API_KEY"));
+	OpenAiApi completionApi = new OpenAiApi(new StaticApiKey(System.getenv("OPENAI_API_KEY")));
 
 	private static <T> T fromJson(String json, Class<T> targetClass) {
 		try {

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/chat/OpenAiChatModeAdditionalHttpHeadersIT.java

@@ -23,6 +23,7 @@
 
 import org.springframework.ai.chat.model.ChatResponse;
 import org.springframework.ai.chat.prompt.Prompt;
+import org.springframework.ai.model.security.StaticApiKey;
 import org.springframework.ai.openai.OpenAiChatModel;
 import org.springframework.ai.openai.OpenAiChatOptions;
 import org.springframework.ai.openai.api.OpenAiApi;
@@ -68,7 +69,7 @@ static class Config {
 
 		@Bean
 		public OpenAiApi chatCompletionApi() {
-			return new OpenAiApi("Invalid API Key");
+			return new OpenAiApi(new StaticApiKey("Invalid API Key"));
 		}
 
 		@Bean

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/chat/OpenAiChatModelFunctionCallingIT.java

@@ -26,6 +26,7 @@
 import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.ai.model.security.StaticApiKey;
 import reactor.core.publisher.Flux;
 
 import org.springframework.ai.chat.messages.AssistantMessage;
@@ -197,7 +198,7 @@ static class Config {
 
 		@Bean
 		public OpenAiApi chatCompletionApi() {
-			return new OpenAiApi(System.getenv("OPENAI_API_KEY"));
+			return new OpenAiApi(new StaticApiKey(System.getenv("OPENAI_API_KEY")));
 		}
 
 		@Bean

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/chat/OpenAiChatModelObservationIT.java

@@ -24,6 +24,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
+import org.springframework.ai.model.security.StaticApiKey;
 import reactor.core.publisher.Flux;
 
 import org.springframework.ai.chat.metadata.ChatResponseMetadata;
@@ -167,7 +168,7 @@ public TestObservationRegistry observationRegistry() {
 
 		@Bean
 		public OpenAiApi openAiApi() {
-			return new OpenAiApi(System.getenv("OPENAI_API_KEY"));
+			return new OpenAiApi(new StaticApiKey(System.getenv("OPENAI_API_KEY")));
 		}
 
 		@Bean

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/chat/OpenAiChatModelProxyToolCallsIT.java

@@ -32,6 +32,7 @@
 import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.ai.model.security.StaticApiKey;
 import reactor.core.publisher.Flux;
 
 import org.springframework.ai.chat.messages.AssistantMessage;
@@ -355,7 +356,7 @@ static class Config {
 
 		@Bean
 		public OpenAiApi chatCompletionApi() {
-			return new OpenAiApi(System.getenv("OPENAI_API_KEY"));
+			return new OpenAiApi(new StaticApiKey(System.getenv("OPENAI_API_KEY")));
 		}
 
 		@Bean

models/spring-ai-openai/src/test/java/org/springframework/ai/openai/chat/OpenAiChatModelResponseFormatIT.java

@@ -30,6 +30,7 @@
 import org.springframework.ai.chat.model.ChatResponse;
 import org.springframework.ai.chat.prompt.Prompt;
 import org.springframework.ai.converter.BeanOutputConverter;
+import org.springframework.ai.model.security.StaticApiKey;
 import org.springframework.ai.openai.OpenAiChatModel;
 import org.springframework.ai.openai.OpenAiChatOptions;
 import org.springframework.ai.openai.api.OpenAiApi;
@@ -186,7 +187,7 @@ static class Config {
 
 		@Bean
 		public OpenAiApi chatCompletionApi() {
-			return new OpenAiApi(System.getenv("OPENAI_API_KEY"));
+			return new OpenAiApi(new StaticApiKey(System.getenv("OPENAI_API_KEY")));
 		}
 
 		@Bean