From 5d41610fb35e4160d9a583d4ff015591d658bec9 Mon Sep 17 00:00:00 2001 From: Mark Date: Sat, 19 Sep 2026 08:10:34 +0200 Subject: [PATCH 1/2] docs(llm_local): document the mock API key The README does mention sk-mock-key, in the chat completion curl example and in a Notes bullet near the bottom. What it lacks is the key anywhere a reader looks before their first request: there is no authentication section, and the base URL appears without it. Point a client at http://localhost:8000/v1, get a 401, and nothing explains why until a curl example further down. This adds an Authentication subsection at the top of Testing the Mock API, saying which routes need the header and what a missing header, a wrong key and a non-Bearer scheme each return. No other prose changed. Closes #83. --- sandboxes/llm_local/README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/sandboxes/llm_local/README.md b/sandboxes/llm_local/README.md index 6882e3e..2f698da 100644 --- a/sandboxes/llm_local/README.md +++ b/sandboxes/llm_local/README.md @@ -224,6 +224,27 @@ Run `make help` to see all commands: ## Testing the Mock API +### Authentication + +Every `/v1/*` route needs this header: + +``` +Authorization: Bearer sk-mock-key +``` + +`/health` does not. The key is not a secret — `make up` prints it, the clients hardcode it, and +it is listed below under Notes. + +Point an OpenAI-compatible client at `http://localhost:8000/v1` with `sk-mock-key` as its API key. + +What a request without a good header gets back: + +| Header sent | Response | +|---|---| +| none | `401 Missing Authorization header, expected: Bearer sk-mock-key` | +| `Basic sk-mock-key` | `401 Invalid authentication scheme` | +| `Bearer something-else` | `401 Invalid API key` | + ### Health Check ```bash curl http://localhost:8000/health From f127a740b446552bd6b82cea8348cabcec471b68 Mon Sep 17 00:00:00 2001 From: Mark Date: Sun, 20 Sep 2026 08:21:36 +0200 Subject: [PATCH 2/2] docs(llm_local): follow #86's 401 wording Felipe's review on #87: the response documented here is the one #86 changes, so the table now reads `401 Missing Authorization header` with no credential in it. Also drops an em-dash from the Authentication paragraph. --- sandboxes/llm_local/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sandboxes/llm_local/README.md b/sandboxes/llm_local/README.md index 2f698da..4cd1309 100644 --- a/sandboxes/llm_local/README.md +++ b/sandboxes/llm_local/README.md @@ -232,7 +232,7 @@ Every `/v1/*` route needs this header: Authorization: Bearer sk-mock-key ``` -`/health` does not. The key is not a secret — `make up` prints it, the clients hardcode it, and +`/health` does not. The key is public by design: `make up` prints it, the clients hardcode it, and it is listed below under Notes. Point an OpenAI-compatible client at `http://localhost:8000/v1` with `sk-mock-key` as its API key. @@ -241,7 +241,7 @@ What a request without a good header gets back: | Header sent | Response | |---|---| -| none | `401 Missing Authorization header, expected: Bearer sk-mock-key` | +| none | `401 Missing Authorization header` | | `Basic sk-mock-key` | `401 Invalid authentication scheme` | | `Bearer something-else` | `401 Invalid API key` |