Generate a random PROXY_API_KEY by default and mask it in startup/UI output

[chenshj73]

Hi, I noticed two related proxy-key handling issues while reviewing the startup and setup paths.

In the current main branch (b3fecbf), PROXY_API_KEY protects both OpenAI-compatible and Anthropic-compatible endpoints, but the setup tool and reset flow can set it to a fixed public value.

The endpoint checks depend directly on PROXY_API_KEY in src/proxy_app/main.py:

# lines 666-672
async def verify_api_key(auth: str = Depends(api_key_header)):
    if not PROXY_API_KEY:
        return auth
    if not auth or auth != f"Bearer {PROXY_API_KEY}":
        raise HTTPException(status_code=401, detail="Invalid or missing API Key")
    return auth

# lines 680-694
async def verify_anthropic_api_key(...):
    if x_api_key and x_api_key == PROXY_API_KEY:
        return x_api_key
    if auth and auth == f"Bearer {PROXY_API_KEY}":
        return auth
    raise HTTPException(status_code=401, detail="Invalid or missing API Key")

However, first-time setup writes a hard-coded default in src/rotator_library/credential_tool.py:

# lines 1095-1111
if get_key(str(_get_env_file()), "PROXY_API_KEY") is None:
    default_key = "VerysecretKey"
    set_key(str(_get_env_file()), "PROXY_API_KEY", default_key)

The launcher reset flow also resets to the same fixed value in src/proxy_app/launcher_tui.py:

# lines 728-785
default_api_key = "VerysecretKey"
...
LauncherConfig.update_proxy_api_key(default_api_key)
...
self.console.print(f"   Proxy API Key:      {default_api_key}")

The current startup banner also prints the full proxy key in src/proxy_app/main.py:

# lines 87-97
proxy_api_key = os.getenv("PROXY_API_KEY")
if proxy_api_key:
    key_display = f"✓ {proxy_api_key}"
...
print(f"Proxy API Key: {key_display}")

The same header is printed again after clearing the screen:

# lines 248-252
print(f"Starting proxy on {args.host}:{args.port}")
print(f"Proxy API Key: {key_display}")

And the launcher status screen prints the full value in src/proxy_app/launcher_tui.py:

# lines 454-457
proxy_key = os.getenv("PROXY_API_KEY")
if proxy_key:
    self.console.print(f"   Proxy API Key:       {proxy_key}")

Minimal reproduction:

1. Run first-time setup without an existing PROXY_API_KEY, or use the launcher reset-to-defaults flow.
2. Observe that .env receives PROXY_API_KEY=VerysecretKey.
3. Start the proxy and observe that the full proxy key is printed in startup output.
4. Any client can authenticate with Authorization: Bearer VerysecretKey unless the user manually changes it.

Why this matters:

• A fixed default key means fresh installs or reset installs can share the same bearer credential.
• If the proxy is bound beyond localhost, deployed behind a tunnel/reverse proxy, or hosted on a platform, anyone who knows the default can call the relay.
• The full key in startup output/UI can leak through Docker logs, Render logs, terminal recordings, screenshots, or support bundles.
• This is especially sensitive for an LLM relay because the proxy key gates access to all configured provider credentials behind the service.

Suggested fix:

• Generate a random first-boot/default key, for example with secrets.token_urlsafe(32).
• Do not reset to a hard-coded shared key.
• Display only a masked value such as sk-...abcd, or show "Set" without revealing the secret.
• Optionally print the full generated key only once during setup, with an explicit warning that it will not be shown again.
• Consider masking both startup and launcher status output consistently.

Thanks for maintaining the project.

[Mirrobot-Agent]

@chenshj73 Thanks for the thorough report — you clearly did your homework, with line references and everything. A hard-coded default proxy key plus full-key display in startup output is exactly the kind of thing worth tightening up. I'll verify each claim against the current main and report back shortly.

[Mirrobot-Agent]

Initial Analysis Report

Summary: Every claim in the report checks out at b3fecbf — first-time setup and the launcher reset flow both write a hard-coded shared PROXY_API_KEY ("VerysecretKey"), and the full key is printed in the startup banner, the post-clear header, and the launcher status/reset screens; I additionally found that the proxy binds 0.0.0.0 by default on direct start, which makes the fixed-key issue more than theoretical.

Issue Validation: Confirmed — all cited code verified; behavior reproduced in a sandbox.

Reproducibility Assessment: Reproducible — I ran the exact ensure_env_defaults() logic (get_key → set_key) against a fresh .env in a sandbox and it wrote PROXY_API_KEY='VerysecretKey', precisely as reported. The banner/status printing is plain print/console.print of the env value, deterministic on any start.

Root Cause Analysis:

The default originates in one place and is mirrored in a second:

• src/rotator_library/credential_tool.py:1106-1111 — ensure_env_defaults() writes the literal "VerysecretKey" whenever PROXY_API_KEY is absent from .env. This function is reached from three entry points: first-run onboarding in src/proxy_app/main.py:1672 (with a retry at :1691), the launcher's first-run setup (src/proxy_app/launcher_tui.py:1111), and the credential tool's main flow (credential_tool.py:2184).
• src/proxy_app/launcher_tui.py:733 — the "Reset to Default Settings" flow re-applies the same literal via LauncherConfig.update_proxy_api_key(default_api_key) (:776) and then prints it (:785).

Both auth dependencies compare directly against this value (verify_api_key at src/proxy_app/main.py:666-673, verify_anthropic_api_key at :680-694), so anyone knowing the public default can authenticate. The key display then leaks it:

• Startup banner: src/proxy_app/main.py:88-96
• Reprinted header after screen clear: src/proxy_app/main.py:249-253
• Launcher status screen: src/proxy_app/launcher_tui.py:454-457

History: introduced in e8d627c (Oct 2025, interactive setup) and propagated to the reset flow in c5716c1 (Dec 2025).

Findings beyond the report (found while verifying — all in the same vein):

Severity	Location — Finding
🟠 Major	src/proxy_app/main.py:18 — --host defaults to 0.0.0.0, so direct starts bind all interfaces by default (the launcher default is 127.0.0.1, but python -m proxy_app.main and Docker do not). The report's "if bound beyond localhost" caveat therefore applies to the default direct-start path, and docker-compose.yml publishes the port.
🟡 Minor	docker-compose.yml + banner — Docker's json-file logging persists the full key from the startup banner into container logs (with PYTHONUNBUFFERED=1 ensuring it's flushed).
🟡 Minor	src/proxy_app/launcher_tui.py:758 — the reset confirmation table shows the first 20 chars of the current key in cleartext.
🟡 Minor	src/proxy_app/launcher_tui.py:687-690 — the change-key prompt uses Prompt.ask(..., default=current), and Rich renders the default in the prompt, revealing the current key.
🔵 Info	src/proxy_app/launcher_tui.py:595 — one status line already masks correctly (✓ Set / ✗ Not Set); a good in-repo precedent to standardize on.

Suggested Labels: security, enhancement (the masking part could be seen as bug-adjacent; either fits). CWE-wise this maps to CWE-798 (hard-coded credential) + CWE-532 (cleartext secret in logs/output).

Proposed Next Steps:

1. Random first-boot key — in ensure_env_defaults() (credential_tool.py:1106), replace the literal with secrets.token_urlsafe(32); print the generated key exactly once during setup with a "will not be shown again" warning (as the report suggests).
2. Reset flow — in launcher_tui.py:733, either generate a fresh random key on reset or prompt for one; never re-apply a fixed shared value. Show the result masked (or once, with the same one-time warning).
3. Consistent masking — standardize on the existing ✓ Set pattern (launcher_tui.py:595) across: the startup banner (main.py:88-96), the post-clear header (main.py:249-253), the launcher status screen (launcher_tui.py:454-457), and the reset confirmation table (launcher_tui.py:758). A small mask_key() helper (e.g. sk-...abcd or plain "Set") would cover all of them.
4. Change-key prompt — don't expose the current key as a visible prompt default (launcher_tui.py:687-690); ask for confirmation of "no change" instead.
5. Legacy-install safety net (optional but worthwhile) — since VerysecretKey has been the default since Oct 2025, existing installs carry it. A startup warning when the key equals the known default ("you are using the shipped default key — rotate it") would catch them.
6. Tests — unit tests that ensure_env_defaults() generates a unique random value across runs and that display helpers never emit the full key.

Missing Information: None — the report is accurate, well-referenced, and complete. No further input needed from the filer.

This analysis was generated by an AI assistant.

[chenshj73]

hh,the agent is 🔥