Support multiple API keys in PROXY_API_KEY

[csader]

Use Case

When using the gateway with multiple clients (e.g., Claude Code CLI, Open Design desktop app), it's useful to have separate API keys per client. This allows:

• Key rotation without downtime — add a new key, migrate clients, then remove the old one
• Per-client revocation — disable one client without breaking others
• Avoiding special character issues — some clients (e.g., Open Design) URL-encode the API key, breaking keys that contain # or %. A second alphanumeric-only key solves this without changing the primary key

Proposed Behavior

Allow PROXY_API_KEY to accept a comma-separated list of valid keys:

PROXY_API_KEY="primary-key,secondary-key-for-another-app"

A request is authenticated if its key matches any entry in the list. Single-key setups continue to work unchanged.

Implementation (what I did locally)

In config.py:

PROXY_API_KEYS: list = [k.strip() for k in os.getenv("PROXY_API_KEY", "my-super-secret-password-123").split(",")]

In the verify functions (routes_openai.py and routes_anthropic.py):

if auth_header and any(auth_header == f"Bearer {k}" for k in PROXY_API_KEYS):
    return True
if x_api_key and x_api_key in PROXY_API_KEYS:
    return True

Happy to submit a PR if you'd like, or if you prefer a different approach (separate env var, JSON array, per-key labels for audit logging, etc.) I can adjust.

[ankitcharolia]

@csader could you give a try to this gateway: https://github.com/ankitcharolia/kiro-gateway