fix: ensure API key passthrough works for OpenAI embedding models

[onematchfox]

At present, one can set apiKeyPassthrough: true on an embedding model, however the field is completely ignored. This PR ensures that the field is honored in line with the implementation for chat completions calls.

[onematchfox]

CI failures seem unrelated to this work. Linting issues were introduced in #2442. Unit tests + upgrade tests also failed on that PRs merge commit (not sure when they started failing though).

[Copilot]

Pull request overview

This PR makes apiKeyPassthrough effective for embedding model calls by propagating the incoming request’s Bearer token into embedding SDK/client authentication, aligning embedding behavior with existing chat/completions passthrough patterns across the Python ADK runtime and Go ADK embedding implementations.

Changes:

• Add api_key_passthrough to embedding config types and wire it into OpenAI/Azure OpenAI embedding client construction (Python).
• Introduce a shared Bearer-token ContextVar and set it during A2A request conversion so background memory/embedding consumers can access the caller token (Python).
• Plumb api_key_passthrough through Go ADK config/types and add passthrough request options + tests for OpenAI/Azure OpenAI/Foundry embeddings (Go), plus docs clarification.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/packages/kagent-adk/tests/unittests/test_embedding.py	Adds unit tests validating embedding API key passthrough behavior and token reset between tests.
python/packages/kagent-adk/tests/unittests/test_agent_executor.py	Adds tests ensuring bearer token context is set/cleared based on incoming Authorization header.
python/packages/kagent-adk/src/kagent/adk/types.py	Adds api_key_passthrough to EmbeddingConfig.
python/packages/kagent-adk/src/kagent/adk/models/_embedding.py	Implements passthrough API key selection and passes it into OpenAI/Azure OpenAI embedding SDK clients.
python/packages/kagent-adk/src/kagent/adk/_llm_passthrough_plugin.py	Reuses shared bearer token extraction helper rather than duplicating logic.
python/packages/kagent-adk/src/kagent/adk/_bearer_token.py	Introduces shared bearer token ContextVar and extract_bearer_token helper.
python/packages/kagent-adk/src/kagent/adk/_agent_executor.py	Stores extracted Bearer token into a ContextVar during request conversion for downstream consumers.
go/api/adk/types.go	Adds api_key_passthrough to EmbeddingConfig and propagates it through model→embedding conversions.
go/api/adk/types_test.go	Adds tests for EmbeddingConfig JSON unmarshalling and model→embedding passthrough propagation.
go/adk/pkg/models/openai.go	Refactors passthrough option resolution to use shared PassthroughToken.
go/adk/pkg/models/base.go	Adds PassthroughToken helper for consistent context token resolution.
go/adk/pkg/models/anthropic.go	Refactors Anthropic passthrough to use shared PassthroughToken.
go/adk/pkg/embedding/foundry_embedding_test.go	Adds Foundry embedding passthrough tests and reuses shared embedding response helper.
go/adk/pkg/embedding/embedding.go	Implements embedding passthrough request options and adds passthrough placeholder handling for Azure-family providers.
go/adk/pkg/embedding/embedding_test.go	Adds OpenAI/Azure OpenAI embedding passthrough tests and consolidates embedding response helpers.
docs/architecture/crds-and-types.md	Documents which embedding providers honor apiKeyPassthrough under memory.modelConfig.

Suppressed comments (1)

go/adk/pkg/embedding/embedding.go:442

• Same as Azure OpenAI: enabling api_key_passthrough currently overwrites any configured/static Foundry API key with the "passthrough" placeholder. If the caller context does not include a bearer token, requests will be made with an invalid Api-Key: passthrough instead of falling back to the static key.

	// past DefaultAzureCredential resolution the same way it does for chat.
	apiKey := os.Getenv(azureai.FoundryAPIKeyEnvVar)
	if cfg.APIKeyPassthrough {
		apiKey = "passthrough"
	}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.