ldrouter 1.11.0 → 1.11.2

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.11.1] - 2026-09-02
+
+### Fixed
+
+- **Custom API keys without an `ld-` prefix now authenticate**: the API-key creation form accepts any custom key value, but gateway authentication rejected every key not starting with `ld-` (401 "Invalid API key format"), making custom keys unusable. Authentication now accepts any stored secret verbatim — auto-generated keys still use the `ld-<base64url(32 bytes)>` format.
+
 ## [1.11.0] - 2026-09-01
 
 ### Added

package/dist/server/auth/api-key.js

@@ -37,9 +37,8 @@ export function authenticateGatewayKey(req) {
         candidate = anthropic;
     if (!candidate)
         return null;
-    if (!candidate.startsWith('ld-')) {
-        throw new GatewayError('authentication_error', 'Invalid API key format', { status: 401 });
-    }
+    // Custom keys are stored verbatim (no prefix requirement); auto-generated
+    // keys start with ld-, but authentication must accept any stored secret.
     const digest = sha256Hex(candidate);
     const db = getDb();
     const row = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.keyDigest, digest)).get();

package/dist/server/db/schema.js

@@ -188,7 +188,8 @@ export const modelAliases = sqliteTable('model_aliases', {
     aliasIdx: uniqueIndex('uniq_alias').on(t.alias),
 }));
 // ============================================================================
-// API keys (gateway keys with ld- prefix)
+// API keys (gateway keys; auto-generated ones start with ld-, but custom
+// values without prefix are now supported)
 // ============================================================================
 export const apiKeys = sqliteTable('api_keys', {
     id: text('id').primaryKey(),

package/dist/server/security/redact.js

@@ -39,7 +39,7 @@ const DEFAULT_SECRET_KEYS = [
 ];
 const SECRET_KEY_REGEX = /(authorization|api[-_]?key|api[-_]?secret|password|passwd|secret|token|cookie|master[-_]?key|totp|recovery|private[-_]?key|session)/i;
 const PLAINTEXT_PATTERNS = [
-    /\bld-[A-Za-z0-9_-]{20,}\b/g, // gateway api keys
+    /\bld-[A-Za-z0-9_-]{20,}\b/g, // auto-generated gateway api keys (custom keys are covered by the Bearer/x-api-key patterns below)
     /(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi,
     /sk-[A-Za-z0-9_-]{12,}/g, // OpenAI-style
     /anthropic[_-]?[A-Za-z0-9_-]{20,}/gi,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldrouter",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "LateDev Router — lightweight self-hosted LLM gateway with admin UI",
   "type": "module",
   "license": "MIT",