AI Chat: Custom endpoint fails with "Invalid API key" when OpenAI key is empty — wrong credential resolved for custom+openai provider

[xtraxion]

Bug Summary

When a Custom OpenAI-compatible API endpoint (e.g. local LLM, proxy, Manifest) is configured via gptBaseUrl + gptBaseUrlKey, the AI Inline Completion and Chat features fail with "Invalid API key (401)" even though the Endpoint-Test button succeeds. The root cause is that the frontend sends provider: "openai" for custom endpoints, but the backend resolves credentials from gptKey instead of gptBaseUrlKey.

Steps to Reproduce

1. Leave the "OpenAI / ChatGPT API key" (gptKey) empty.
2. Enter a "Custom API Base URL" (e.g. http://192.168.1.10:11434/v1).
3. Enter a valid "Custom API key" (gptBaseUrlKey, e.g. mnfst_xxx for Manifest).
4. Save the adapter config and restart.
5. Open the JavaScript editor → click the AI Chat button.
6. Observe: Endpoint test returns "ok", but actual chat/completion returns "Invalid API key (401)".

Expected Behavior

When gptBaseUrl is configured and gptBaseUrlKey contains a key, the adapter should use gptBaseUrlKey for requests sent to that custom base URL, not gptKey.

Actual Behavior

The frontend (AiInlineProvider-CaHd2G2Q.js) maps provider: "custom" → provider: "openai" + baseUrl.

let providers = ['custom','openai','deepseek','anthropic','gemini'];
for (let e of providers) {
    let t = n.providers.find(t => t.provider === e);
    if (t) {
        d = e === 'custom' ? 'openai' : e;  // "custom" becomes "openai"
        f = t.baseUrl || '';
        break;
    }
}

The backend (aiProviderResolver.ts / build/lib/aiProviderResolver.js) then resolves credentials based on provider:

const PROVIDER_KEY_FIELD = {
    openai: 'gptKey',          // ← wrong field for custom endpoint
    anthropic: 'claudeKey',
    gemini: 'geminiKey',
    deepseek: 'deepseekKey',
    custom: 'gptBaseUrlKey',   // ← never reached
};

Since provider === 'openai' and gptKey is empty, the adapter sends an empty or wrong API key to the custom endpoint, resulting in 401.

Environment

• Adapter: ioBroker.javascript v10.1.3
• Node.js: v24.x (also reproducible on v22)
• Credential mode: both manual and manager affected

Workaround

As a workaround, enter the Custom API key into the "OpenAI / ChatGPT API key" field (gptKey) instead of the "Custom API key" field (gptBaseUrlKey). This works because the backend treats custom endpoints as provider: 'openai' and reads from gptKey. However, this makes it impossible to use both OpenRouter (or real OpenAI) and a custom endpoint simultaneously, because both would share the same gptKey field.

Suggested Fix

Option A: In aiProviderResolver.resolveProviderCredentials, check if a custom baseUrl is present alongside provider === 'openai'. If so, prefer gptBaseUrlKey over gptKey.

Option B: Preserve provider: 'custom' through the entire flow instead of rewriting it to 'openai' in the frontend. Then the backend naturally resolves gptBaseUrlKey.

Option C: Add a dedicated provider type mapping: when baseUrl is set and differs from the default OpenAI URL, automatically use the custom credentials.

Related

• PR feat: support custom OpenAI-compatible API endpoints #2135 (Custom OpenAI-compatible endpoints)
• PR feat: AI Chat panel with multi-provider support and tool calling #2195 (AI Chat panel with multi-provider support)

[xtraxion]

Additional confirmed behavior / workaround:

After further testing, this is not only a “wrong key field” problem. The current implementation effectively requires the same API key to be stored in both gptKey and gptBaseUrlKey for custom OpenAI-compatible endpoints to work across all AI UI paths.

Observed behavior in ioBroker.javascript 10.1.3:

UI path	provider sent to backend	backend credential field	Required key field
Admin settings Test button	openai	gptKey unless current form value is passed as messageApiKey	usually works from form value
Inline Completion	openai (because frontend maps custom → openai)	gptKey	gptKey must contain the custom endpoint key
AI Chat panel	custom via providerMap	gptBaseUrlKey	gptBaseUrlKey must contain the custom endpoint key

So the current user-facing workaround is:

1. Configure gptBaseUrl, e.g. http://host:port/v1.
2. Put the same custom endpoint API key into both:
   • gptKey / “OpenAI API key”
   • gptBaseUrlKey / “Custom API key”

If only gptBaseUrlKey is set, Inline Completion can fail because it resolves through provider: "openai" and reads gptKey.

If only gptKey is set, the AI Chat panel can fail because it preserves provider: "custom" and reads gptBaseUrlKey.

This is confusing because the UI suggests that the Custom API key field is sufficient for a Custom Base URL. It also prevents using a real OpenAI/OpenRouter key and a custom endpoint key independently, because one path expects the custom key in the OpenAI key field.

A fix should make all UI paths resolve custom endpoint credentials consistently — either by preserving provider: "custom" everywhere, or by making backend credential resolution prefer gptBaseUrlKey whenever a custom baseUrl is being used.