server/src/lib/credential.ts

/** The sentinel the Keys page stores for key-optional platforms and auth-off
 * custom endpoints (routes/keys.ts keeps `no-key`), plus the empty string a
 * caller can hand a provider when no credential exists. Anything else is a
 * real key (#1331). */
export const NO_KEY_SENTINEL = 'no-key';

export function isAnonymousCredential(apiKey: string | null | undefined): boolean {
  const v = apiKey?.trim() ?? '';
  return v === '' || v === NO_KEY_SENTINEL;
}

/** `Authorization: Bearer <key>` for a real key, nothing for the sentinel:
 * upstreams read `Bearer no-key` as an invalid key, so anonymous calls must
 * omit the header entirely (#1331). */
export function bearerAuthHeader(apiKey: string | null | undefined): Record<string, string> {
  if (isAnonymousCredential(apiKey)) return {};
  return { Authorization: `Bearer ${apiKey!.trim()}` };
}