fix(llm): Send google API key via headers instead of query params (security fix)

Ololoshechkin · Ololoshechkin · commit a54d9081022a · 2026-05-06T17:03:28.000+02:00
diff --git a/prompt/prompt-executor/prompt-executor-clients/prompt-executor-google-client/src/commonMain/kotlin/ai/koog/prompt/executor/clients/google/GoogleLLMClient.kt b/prompt/prompt-executor/prompt-executor-clients/prompt-executor-google-client/src/commonMain/kotlin/ai/koog/prompt/executor/clients/google/GoogleLLMClient.kt
@@ -143,7 +143,7 @@ public open class GoogleLLMClient @JvmOverloads constructor(
             connectTimeoutMillis = settings.timeoutConfig.connectTimeoutMillis,
             socketTimeoutMillis = settings.timeoutConfig.socketTimeoutMillis,
             json = json,
-            queryParameters = mapOf("key" to apiKey),
+            headers = mapOf("x-goog-api-key" to apiKey),
         )
     }
 

Original file line number	Diff line number	Diff line change
`@@ -143,7 +143,7 @@ public open class GoogleLLMClient @JvmOverloads constructor(`
`143`	`143`	`connectTimeoutMillis = settings.timeoutConfig.connectTimeoutMillis,`
`144`	`144`	`socketTimeoutMillis = settings.timeoutConfig.socketTimeoutMillis,`
`145`	`145`	`json = json,`
`146`		`- queryParameters = mapOf("key" to apiKey),`
	`146`	`+ headers = mapOf("x-goog-api-key" to apiKey),`
`147`	`147`	`)`
`148`	`148`	`}`
`149`	`149`