From 467d19357dc0f5331e2d605902694c91735bfff1 Mon Sep 17 00:00:00 2001 From: Nathan Schneider Date: Sun, 18 Oct 2026 23:29:16 -0600 Subject: [PATCH] librechat-sandbox: per-member key auto-load (portal feed + sync-keys.js), redaction gotcha --- maintenance/librechat-sandbox.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/maintenance/librechat-sandbox.md b/maintenance/librechat-sandbox.md index ced4236..e99f0fd 100644 --- a/maintenance/librechat-sandbox.md +++ b/maintenance/librechat-sandbox.md @@ -106,6 +106,29 @@ summary. overriding the Tailwind CSS variables on `html.light`/`html.dark` (`--surface-primary`, `--accent-primary`, …) from the overlay `custom.css`. + +## Per-member key auto-load (no API-key prompts) + +Members never enter an API key. The portal provisions each member's LiteLLM +key at onboarding; the sandbox seeds it into LibreChat's user-key store: + +- `GET /admin/librechat/keys` on the portal returns active members' chat keys + (dedicated `X-Sync-Token` auth — `LIBRECHAT_SYNC_TOKEN` on both apps). +- `/app/data/sync-keys.js` (in the LibreChat container, mirrored in the repo + as `sync-keys.js`) fetches that feed and seeds the `keys` collection + (chat endpoint, `apiKey: "user_provided"`) and `pluginauths` + (`mcp:inference-image` → `IC_API_KEY`, injected per-user via + `customUserVars` so image generation bills to the member's own team). +- Members without a sandbox account are skipped until they first log in; run + the sync after onboarding waves and on a schedule (the command is in the + repo README). Idempotent. +- Encryption matches LibreChat's own (`CREDS_KEY`/`CREDS_IV`, read from + `/proc/1/environ` — exec sessions don't inherit the app env). + +> Terminal output redacts values after `apiKey:` as `***` even for harmless +> strings (`user_provided`, `${TTS_API_KEY}`). Probe lengths/counts instead +> of trusting redacted output. + ## Verification (after any change) ```bash