fix(security): keep Gemini key out of request URLs

2026-04-29 22:56:12 +08:00
parent b857be0a64
commit d845d53257
8 changed files with 72 additions and 9 deletions
--- a/apps/api/src/services/model_version_probe.py
+++ b/apps/api/src/services/model_version_probe.py
@@ -105,7 +105,8 @@ async def probe_gemini_version() -> ProviderVersionInfo:
    async with httpx.AsyncClient(timeout=8.0) as client:
        resp = await client.get(
            "https://generativelanguage.googleapis.com/v1beta/models",
-            params={"key": api_key, "pageSize": 50},
+            params={"pageSize": 50},
+            headers={"x-goog-api-key": api_key},
        )
        resp.raise_for_status()
        data = resp.json()