fix(security): keep Gemini key out of request URLs

2026-04-29 22:56:12 +08:00
parent b857be0a64
commit d845d53257
8 changed files with 72 additions and 9 deletions
--- a/apps/api/src/services/chat_manager.py
+++ b/apps/api/src/services/chat_manager.py
@@ -119,7 +119,8 @@ class ChatManager:
        try:
            async with httpx.AsyncClient(timeout=30.0) as client:
                resp = await client.post(
-                    f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent?key={api_key}",
+                    f"https://generativelanguage.googleapis.com/v1beta/models/{model}:generateContent",
+                    headers={"x-goog-api-key": api_key},
                    json={
                        "system_instruction": {"parts": [{"text": system_prompt}]},
                        "contents": [{"parts": [{"text": user_message}]}],