From 978fe337bfa56cb567f5c56ee3002103ac48dc29 Mon Sep 17 00:00:00 2001 From: John Paul Soliva Date: Mon, 28 Sep 2026 19:26:05 +0900 Subject: [PATCH] docs(env): an OPENAI_BASE_URL-bound OPENAI_API_KEY goes only to that origin (cherry picked from commit e2a64b83239b22e97a02ed4d7898dbc68c11ee3d) --- website/docs/reference/environment-variables.md | 2 +- .../current/reference/environment-variables.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/website/docs/reference/environment-variables.md b/website/docs/reference/environment-variables.md index 0eb4fe936b..59c7fd61eb 100644 --- a/website/docs/reference/environment-variables.md +++ b/website/docs/reference/environment-variables.md @@ -21,7 +21,7 @@ Hermes reads environment variables from the process environment and, for user-ma | `NOUS_INFERENCE_BASE_URL` | Override Nous inference endpoint directly | | `AI_GATEWAY_API_KEY` | Vercel AI Gateway API key ([ai-gateway.vercel.sh](https://ai-gateway.vercel.sh)) | | `AI_GATEWAY_BASE_URL` | Override AI Gateway base URL (default: `https://ai-gateway.vercel.sh/v1`) | -| `OPENAI_API_KEY` | OpenAI API key (`openai-api` provider), or the key for a custom OpenAI-compatible endpoint when `OPENAI_BASE_URL` is set. Counts as an OpenRouter key only when it starts with `sk-or-`; put OpenRouter keys in `OPENROUTER_API_KEY` | +| `OPENAI_API_KEY` | OpenAI API key (`openai-api` provider), or the key for a custom OpenAI-compatible endpoint when `OPENAI_BASE_URL` is set; bound that way, it is sent only to that URL's exact origin (scheme, host and port), never to another port or to `http://` on the same host. Counts as an OpenRouter key only when it starts with `sk-or-`; put OpenRouter keys in `OPENROUTER_API_KEY` | | `OPENAI_BASE_URL` | Base URL for custom endpoint (VLLM, SGLang, etc.) | | `HERMES_CODEX_BASE_URL` | Route the `openai-codex` (ChatGPT subscription) provider through a proxy instead of the default Codex backend. Applies everywhere the credential is used: pool resolution, auxiliary/raw clients, and 401/429 credential rotation. `model.base_url` under `model.provider: openai-codex` is the secondary override when this is unset. | | `LM_API_KEY` | API key for LM Studio (`lmstudio` provider). Often a placeholder for local servers | diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/reference/environment-variables.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/reference/environment-variables.md index 810202f363..585dd92154 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/reference/environment-variables.md +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/reference/environment-variables.md @@ -20,7 +20,7 @@ description: "Hermes Agent 使用的所有环境变量完整参考" | `NOUS_INFERENCE_BASE_URL` | 直接覆盖 Nous 推理端点 | | `AI_GATEWAY_API_KEY` | Vercel AI Gateway API 密钥（[ai-gateway.vercel.sh](https://ai-gateway.vercel.sh)） | | `AI_GATEWAY_BASE_URL` | 覆盖 AI Gateway base URL（默认：`https://ai-gateway.vercel.sh/v1`） | -| `OPENAI_API_KEY` | 自定义 OpenAI 兼容端点的 API 密钥（与 `OPENAI_BASE_URL` 配合使用） | +| `OPENAI_API_KEY` | 自定义 OpenAI 兼容端点的 API 密钥（与 `OPENAI_BASE_URL` 配合使用）。设置 `OPENAI_BASE_URL` 后，它只会发送到该 URL 完全相同的源（scheme、主机和端口），绝不会发送到同一主机的其他端口或 `http://` | | `OPENAI_BASE_URL` | 自定义端点的 base URL（VLLM、SGLang 等） | | `COPILOT_GITHUB_TOKEN` | 用于 Copilot API 的 GitHub token——最高优先级（OAuth `gho_*` 或细粒度 PAT `github_pat_*`；经典 PAT `ghp_*` **不支持**） | | `GH_TOKEN` | GitHub token——Copilot 第二优先级（也供 `gh` CLI 使用） |