`LocalOpenAIAgentConfig` / `LocalOpenAIConnectionStrategy` cannot pass API keys or auth headers to OpenAI-compatible endpoints

[natemacinnes]

Problem Statement

LocalOpenAIAgentConfig currently supports configuring an OpenAI-compatible endpoint with model and base_url, but there does not appear to be a supported way to pass authentication data such as an API key or custom HTTP headers through to LocalOpenAIConnectionStrategy.

This prevents using OpenAI-compatible proxies or gateways that require authentication, for example LiteLLM, internal OpenAI-compatible model routers, reverse proxies, or hosted/local gateways that require Authorization: Bearer ... or another custom auth header.

Current behaviour

TLDR; api_key=... is not a current config option.

LocalOpenAIAgentConfig.create_strategy() resolves only:

• model_name
• base_url

and passes those to LocalOpenAIConnectionStrategy.

LocalOpenAIConnectionStrategy._build_harness_config() then creates a
gemma_endpoint with only:

gemma_endpoint=localharness_pb2.GemmaEndpoint(
    base_url=self._base_url,
)

Relevant locations:

• google/antigravity/connections/local/local_openai_connection_config.py
• google/antigravity/connections/local/litert_connection.py

Proposed Solution

LocalOpenAIAgentConfig should allow authentication configuration for OpenAI-compatible endpoints, either via:

LocalOpenAIAgentConfig(
model="...",
base_url="https://proxy.example.com/v1",
api_key="...",
)

and/or via a model endpoint/header configuration such as:

LocalOpenAIAgentConfig(
model=ModelTarget(
name="...",
endpoint=GeminiAPIEndpoint(
base_url="https://proxy.example.com/v1",
http_headers={"Authorization": "Bearer ..."},
),
),
)

The configured API key or headers should be forwarded to the local harness so requests to the OpenAI-compatible endpoint include the required authentication.

Add auth/header support to the Local OpenAI connection path:

1. Adding api_key and/or http_headers fields to LocalOpenAIAgentConfig.
2. Resolving those values from either top-level config or ModelTarget.endpoint.
3. Passing them into LocalOpenAIConnectionStrategy.
4. Including them in the harness model endpoint config, assuming the harness proto/runtime supports forwarding headers for this endpoint type.

At minimum, supporting arbitrary http_headers would cover bearer tokens and custom proxy auth schemes.

Alternatives Considered

N/A

Additional Context

Many OpenAI-compatible endpoints are not unauthenticated localhost services. Without auth support, LocalOpenAIAgentConfig only works with unauthenticated servers such as a default local Ollama/LM Studio setup, and cannot be used with common proxy/gateway deployments that require headers.