From b0d691d53f879605585264a3dc80ce2359dc642f Mon Sep 17 00:00:00 2001
From: Hong Jiarong <me@jrhim.com>
Date: Sat, 11 Jul 2026 15:06:48 +0800
Subject: [PATCH] Revert "fix: pass provider capability as API key"

This reverts commit f065f9f9784e9d9701786112e4719704c1a09151.
---
 hub/package-lock.json                |  4 ++--
 hub/package.json                     |  2 +-
 hub/src/connections/providerProxy.ts |  4 ++--
 hub/test/unit/provider-proxy.test.ts | 10 +++++-----
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hub/package-lock.json b/hub/package-lock.json
index 27caf6d..e944447 100644
--- a/hub/package-lock.json
+++ b/hub/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.16",
+  "version": "0.0.15",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.16",
+      "version": "0.0.15",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.202",
         "@fastify/cookie": "^11.0.2",
diff --git a/hub/package.json b/hub/package.json
index 4a5ca67..4e77d3c 100644
--- a/hub/package.json
+++ b/hub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.16",
+  "version": "0.0.15",
   "private": true,
   "type": "module",
   "engines": {
diff --git a/hub/src/connections/providerProxy.ts b/hub/src/connections/providerProxy.ts
index b76a2fb..8850fcf 100644
--- a/hub/src/connections/providerProxy.ts
+++ b/hub/src/connections/providerProxy.ts
@@ -80,8 +80,8 @@ export async function openProviderProxyLease(
   return {
     sdkEnv: {
       ANTHROPIC_BASE_URL: `http://127.0.0.1:${address.port}`,
-      ANTHROPIC_AUTH_TOKEN: "",
-      ANTHROPIC_API_KEY: capability,
+      ANTHROPIC_AUTH_TOKEN: capability,
+      ANTHROPIC_API_KEY: "",
     },
     sensitiveValues: [capability],
     async close(): Promise<void> {
diff --git a/hub/test/unit/provider-proxy.test.ts b/hub/test/unit/provider-proxy.test.ts
index 3d2590b..cd7791c 100644
--- a/hub/test/unit/provider-proxy.test.ts
+++ b/hub/test/unit/provider-proxy.test.ts
@@ -52,14 +52,14 @@ describe("run-scoped provider proxy", () => {
     expect(serializedAgentEnv).not.toContain(String(address.port));
     expect(lease.sdkEnv).toMatchObject({
       ANTHROPIC_BASE_URL: expect.stringMatching(/^http:\/\/127\.0\.0\.1:\d+$/),
-      ANTHROPIC_AUTH_TOKEN: "",
-      ANTHROPIC_API_KEY: expect.any(String),
+      ANTHROPIC_AUTH_TOKEN: expect.any(String),
+      ANTHROPIC_API_KEY: "",
     });
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
       method: "POST",
       headers: {
-        "x-api-key": lease.sdkEnv.ANTHROPIC_API_KEY ?? "",
+        authorization: `Bearer ${lease.sdkEnv.ANTHROPIC_AUTH_TOKEN}`,
         "content-type": "application/json",
         "anthropic-version": "2023-06-01",
       },
@@ -127,7 +127,7 @@ describe("run-scoped provider proxy", () => {
     leases.push(lease);
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
-      headers: { "x-api-key": lease.sdkEnv.ANTHROPIC_API_KEY ?? "" },
+      headers: { "x-api-key": lease.sdkEnv.ANTHROPIC_AUTH_TOKEN ?? "" },
     });
 
     expect(response.status).toBe(200);
@@ -167,7 +167,7 @@ describe("run-scoped provider proxy", () => {
     leases.push(lease);
 
     const response = await fetch(`${lease.sdkEnv.ANTHROPIC_BASE_URL}/v1/messages`, {
-      headers: { "x-api-key": lease.sdkEnv.ANTHROPIC_API_KEY ?? "" },
+      headers: { authorization: `Bearer ${lease.sdkEnv.ANTHROPIC_AUTH_TOKEN}` },
       redirect: "manual",
     });