feat(tool): add support for API key authentication via query parameter (#21656)

api/core/tools/custom_tool/provider.py

@@ -39,19 +39,22 @@ class ApiToolProviderController(ToolProviderController):
                 type=ProviderConfig.Type.SELECT,
                 options=[
                     ProviderConfig.Option(value="none", label=I18nObject(en_US="None", zh_Hans="无")),
-                    ProviderConfig.Option(value="api_key", label=I18nObject(en_US="api_key", zh_Hans="api_key")),
+                    ProviderConfig.Option(value="api_key_header", label=I18nObject(en_US="Header", zh_Hans="请求头")),
+                    ProviderConfig.Option(
+                        value="api_key_query", label=I18nObject(en_US="Query Param", zh_Hans="查询参数")
+                    ),
                 ],
                 default="none",
                 help=I18nObject(en_US="The auth type of the api provider", zh_Hans="api provider 的认证类型"),
             )
         ]
-        if auth_type == ApiProviderAuthType.API_KEY:
+        if auth_type == ApiProviderAuthType.API_KEY_HEADER:
             credentials_schema = [
                 *credentials_schema,
                 ProviderConfig(
                     name="api_key_header",
                     required=False,
-                    default="api_key",
+                    default="Authorization",
                     type=ProviderConfig.Type.TEXT_INPUT,
                     help=I18nObject(en_US="The header name of the api key", zh_Hans="携带 api key 的 header 名称"),
                 ),
@@ -74,6 +77,25 @@ class ApiToolProviderController(ToolProviderController):
                     ],
                 ),
             ]
+        elif auth_type == ApiProviderAuthType.API_KEY_QUERY:
+            credentials_schema = [
+                *credentials_schema,
+                ProviderConfig(
+                    name="api_key_query_param",
+                    required=False,
+                    default="key",
+                    type=ProviderConfig.Type.TEXT_INPUT,
+                    help=I18nObject(
+                        en_US="The query parameter name of the api key", zh_Hans="携带 api key 的查询参数名称"
+                    ),
+                ),
+                ProviderConfig(
+                    name="api_key_value",
+                    required=True,
+                    type=ProviderConfig.Type.SECRET_INPUT,
+                    help=I18nObject(en_US="The api key", zh_Hans="api key 的值"),
+                ),
+            ]
         elif auth_type == ApiProviderAuthType.NONE:
             pass
 

api/core/tools/custom_tool/tool.py

@@ -78,8 +78,8 @@ class ApiTool(Tool):
         if "auth_type" not in credentials:
             raise ToolProviderCredentialValidationError("Missing auth_type")
 
-        if credentials["auth_type"] == "api_key":
+        if credentials["auth_type"] in ("api_key_header", "api_key"):  # backward compatibility:
-            api_key_header = "api_key"
+            api_key_header = "Authorization"
 
             if "api_key_header" in credentials:
                 api_key_header = credentials["api_key_header"]
@@ -100,6 +100,11 @@ class ApiTool(Tool):
 
             headers[api_key_header] = credentials["api_key_value"]
 
+        elif credentials["auth_type"] == "api_key_query":
+            # For query parameter authentication, we don't add anything to headers
+            # The query parameter will be added in do_http_request method
+            pass
+
         needed_parameters = [parameter for parameter in (self.api_bundle.parameters or []) if parameter.required]
         for parameter in needed_parameters:
             if parameter.required and parameter.name not in parameters:
@@ -154,6 +159,15 @@ class ApiTool(Tool):
         cookies = {}
         files = []
 
+        # Add API key to query parameters if auth_type is api_key_query
+        if self.runtime and self.runtime.credentials:
+            credentials = self.runtime.credentials
+            if credentials.get("auth_type") == "api_key_query":
+                api_key_query_param = credentials.get("api_key_query_param", "key")
+                api_key_value = credentials.get("api_key_value")
+                if api_key_value:
+                    params[api_key_query_param] = api_key_value
+
         # check parameters
         for parameter in self.api_bundle.openapi.get("parameters", []):
             value = self.get_parameter_value(parameter, parameters)

api/core/tools/entities/tool_entities.py

@@ -96,7 +96,8 @@ class ApiProviderAuthType(Enum):
     """
 
     NONE = "none"
-    API_KEY = "api_key"
+    API_KEY_HEADER = "api_key_header"
+    API_KEY_QUERY = "api_key_query"
 
     @classmethod
     def value_of(cls, value: str) -> "ApiProviderAuthType":

api/core/tools/tool_manager.py

@@ -684,9 +684,16 @@ class ToolManager:
         if provider is None:
             raise ToolProviderNotFoundError(f"api provider {provider_id} not found")
 
+        auth_type = ApiProviderAuthType.NONE
+        provider_auth_type = provider.credentials.get("auth_type")
+        if provider_auth_type in ("api_key_header", "api_key"):  # backward compatibility
+            auth_type = ApiProviderAuthType.API_KEY_HEADER
+        elif provider_auth_type == "api_key_query":
+            auth_type = ApiProviderAuthType.API_KEY_QUERY
+
         controller = ApiToolProviderController.from_db(
             provider,
-            ApiProviderAuthType.API_KEY if provider.credentials["auth_type"] == "api_key" else ApiProviderAuthType.NONE,
+            auth_type,
         )
         controller.load_bundled_tools(provider.tools)
 
@@ -745,9 +752,16 @@ class ToolManager:
             credentials = {}
 
         # package tool provider controller
+        auth_type = ApiProviderAuthType.NONE
+        credentials_auth_type = credentials.get("auth_type")
+        if credentials_auth_type in ("api_key_header", "api_key"):  # backward compatibility
+            auth_type = ApiProviderAuthType.API_KEY_HEADER
+        elif credentials_auth_type == "api_key_query":
+            auth_type = ApiProviderAuthType.API_KEY_QUERY
+
         controller = ApiToolProviderController.from_db(
             provider_obj,
-            ApiProviderAuthType.API_KEY if credentials["auth_type"] == "api_key" else ApiProviderAuthType.NONE,
+            auth_type,
         )
         # init tool configuration
         tool_configuration = ProviderConfigEncrypter(

api/services/tools/tools_transform_service.py

@@ -159,11 +159,16 @@ class ToolTransformService:
         convert provider controller to user provider
         """
         # package tool provider controller
+        auth_type = ApiProviderAuthType.NONE
+        credentials_auth_type = db_provider.credentials.get("auth_type")
+        if credentials_auth_type in ("api_key_header", "api_key"):  # backward compatibility
+            auth_type = ApiProviderAuthType.API_KEY_HEADER
+        elif credentials_auth_type == "api_key_query":
+            auth_type = ApiProviderAuthType.API_KEY_QUERY
+
         controller = ApiToolProviderController.from_db(
             db_provider=db_provider,
-            auth_type=ApiProviderAuthType.API_KEY
+            auth_type=auth_type,
-            if db_provider.credentials["auth_type"] == "api_key"
-            else ApiProviderAuthType.NONE,
         )
 
         return controller

web/app/components/tools/edit-custom-collection-modal/config-credentials.tsx

@@ -68,23 +68,34 @@ const ConfigCredential: FC<Props> = ({
                   text={t('tools.createTool.authMethod.types.none')}
                   value={AuthType.none}
                   isChecked={tempCredential.auth_type === AuthType.none}
-                  onClick={value => setTempCredential({ ...tempCredential, auth_type: value as AuthType })}
+                  onClick={value => setTempCredential({
+                    auth_type: value as AuthType,
+                  })}
                 />
                 <SelectItem
-                  text={t('tools.createTool.authMethod.types.api_key')}
+                  text={t('tools.createTool.authMethod.types.api_key_header')}
-                  value={AuthType.apiKey}
+                  value={AuthType.apiKeyHeader}
-                  isChecked={tempCredential.auth_type === AuthType.apiKey}
+                  isChecked={tempCredential.auth_type === AuthType.apiKeyHeader}
                   onClick={value => setTempCredential({
-                    ...tempCredential,
                     auth_type: value as AuthType,
                     api_key_header: tempCredential.api_key_header || 'Authorization',
                     api_key_value: tempCredential.api_key_value || '',
                     api_key_header_prefix: tempCredential.api_key_header_prefix || AuthHeaderPrefix.custom,
                   })}
                 />
+                <SelectItem
+                  text={t('tools.createTool.authMethod.types.api_key_query')}
+                  value={AuthType.apiKeyQuery}
+                  isChecked={tempCredential.auth_type === AuthType.apiKeyQuery}
+                  onClick={value => setTempCredential({
+                    auth_type: value as AuthType,
+                    api_key_query_param: tempCredential.api_key_query_param || 'key',
+                    api_key_value: tempCredential.api_key_value || '',
+                  })}
+                />
               </div>
             </div>
-            {tempCredential.auth_type === AuthType.apiKey && (
+            {tempCredential.auth_type === AuthType.apiKeyHeader && (
               <>
                 <div>
                   <div className='system-sm-medium py-2 text-text-primary'>{t('tools.createTool.authHeaderPrefix.title')}</div>
@@ -136,6 +147,35 @@ const ConfigCredential: FC<Props> = ({
                   />
                 </div>
               </>)}
+            {tempCredential.auth_type === AuthType.apiKeyQuery && (
+              <>
+                <div>
+                  <div className='system-sm-medium flex items-center py-2 text-text-primary'>
+                    {t('tools.createTool.authMethod.queryParam')}
+                    <Tooltip
+                      popupContent={
+                        <div className='w-[261px] text-text-tertiary'>
+                          {t('tools.createTool.authMethod.queryParamTooltip')}
+                        </div>
+                      }
+                      triggerClassName='ml-0.5 w-4 h-4'
+                    />
+                  </div>
+                  <Input
+                    value={tempCredential.api_key_query_param}
+                    onChange={e => setTempCredential({ ...tempCredential, api_key_query_param: e.target.value })}
+                    placeholder={t('tools.createTool.authMethod.types.queryParamPlaceholder')!}
+                  />
+                </div>
+                <div>
+                  <div className='system-sm-medium py-2 text-text-primary'>{t('tools.createTool.authMethod.value')}</div>
+                  <Input
+                    value={tempCredential.api_key_value}
+                    onChange={e => setTempCredential({ ...tempCredential, api_key_value: e.target.value })}
+                    placeholder={t('tools.createTool.authMethod.types.apiValuePlaceholder')!}
+                  />
+                </div>
+              </>)}
 
           </div>
 

web/app/components/tools/types.ts

@@ -7,7 +7,8 @@ export enum LOC {
 
 export enum AuthType {
   none = 'none',
-  apiKey = 'api_key',
+  apiKeyHeader = 'api_key_header',
+  apiKeyQuery = 'api_key_query',
 }
 
 export enum AuthHeaderPrefix {
@@ -21,6 +22,7 @@ export type Credential = {
   api_key_header?: string
   api_key_value?: string
   api_key_header_prefix?: AuthHeaderPrefix
+  api_key_query_param?: string
 }
 
 export enum CollectionType {

web/i18n/en-US/tools.ts

@@ -80,11 +80,15 @@ const translation = {
       title: 'Authorization method',
       type: 'Authorization type',
       keyTooltip: 'Http Header Key, You can leave it with "Authorization" if you have no idea what it is or set it to a custom value',
+      queryParam: 'Query Parameter',
+      queryParamTooltip: 'The name of the API key query parameter to pass, e.g. "key" in "https://example.com/test?key=API_KEY".',
       types: {
         none: 'None',
-        api_key: 'API Key',
+        api_key_header: 'Header',
+        api_key_query: 'Query Param',
         apiKeyPlaceholder: 'HTTP header name for API Key',
         apiValuePlaceholder: 'Enter API Key',
+        queryParamPlaceholder: 'Query parameter name for API Key',
       },
       key: 'Key',
       value: 'Value',

web/i18n/zh-Hans/tools.ts

@@ -80,11 +80,15 @@ const translation = {
       title: '鉴权方法',
       type: '鉴权类型',
       keyTooltip: 'HTTP 头部名称，如果你不知道是什么，可以将其保留为 Authorization 或设置为自定义值',
+      queryParam: '查询参数',
+      queryParamTooltip: '用于传递 API 密钥查询参数的名称, 如 "https://example.com/test?key=API_KEY" 中的 "key"参数',
       types: {
         none: '无',
-        api_key: 'API Key',
+        api_key_header: '请求头',
+        api_key_query: '查询参数',
         apiKeyPlaceholder: 'HTTP 头部名称，用于传递 API Key',
         apiValuePlaceholder: '输入 API Key',
+        queryParamPlaceholder: '查询参数名称，用于传递 API Key',
       },
       key: '键',
       value: '值',