[APP-14487] Update viam-agent to parse and authenticate with API keys #176

danielbotros · 2025-12-29T20:29:35Z

Description

APP-14487 Update viam-agent to parse and authenticate with API keys

Similar to RDK side of changes found here
Changes related to the Cloud part of the config in order to parse and validate API keys in order to use them as the primary auth credentials moving forward, using secrets as a fallback.
Changes related to propagating API keys to anywhere we need to authenticate (i.e. Net appender) or reading/writing config/creds.

Testing

Config used / manually modified:

{"cloud":{"app_address":"https://app.viam.com:443","id":"<id-value>","secret":"<secret-value>", "api_key":{"id":"<api-key-id>","value":"<api-key-value>"}}}

I tested connecting a agent managed robot to prod app using both a robot part secret, an API key, and both.

danielbotros · 2025-12-31T18:00:25Z

go.mod

+
+replace go.viam.com/rdk => ../rdk
+
+replace github.com/nunnatsa/ginkgolinter => github.com/nunnatsa/ginkgolinter v0.16.2


Need to wait for RDK release with other changes to upgrade RDK version and to test on a PI before merging, but hoping to get some eyes on beforehand.

I'm running in various linter dependency issues with upgrading the RDK. I need to add replace github.com/nunnatsa/ginkgolinter => github.com/nunnatsa/ginkgolinter v0.16.2 to go.mod otherwise I get these errors:

go: finding module for package github.com/nunnatsa/ginkgolinter/types go: github.com/golangci/golangci-lint/cmd/golangci-lint imports github.com/golangci/golangci-lint/pkg/commands imports github.com/golangci/golangci-lint/pkg/lint/lintersdb imports github.com/golangci/golangci-lint/pkg/golinters/ginkgolinter imports github.com/nunnatsa/ginkgolinter/types: module github.com/nunnatsa/ginkgolinter@latest found (v0.21.2), but does not contain package github.com/nunnatsa/ginkgolinter/types

yet I still cannot lint because of this error:

../../go/pkg/mod/github.com/golangci/golangci-lint@v1.64.5/pkg/golinters/dupl/dupl.go:8:2: import "github.com/golangci/dupl" is a program, not an importable package

edobranov · 2025-12-31T21:38:27Z

utils/cloud_utils.go

+type APIKey struct {
+	ID    string `json:"id"`
+	Value string `json:"value"`
+}


Should this say "key" instead of "value" to be consistent with https://github.com/viamrobotics/app/pull/10703?

Yeah good catch thank you!

edobranov · 2025-12-31T21:46:43Z

subsystems/networking/portal_linux.go

 			return
 		}
-		if cfg.Cloud == nil || (cfg.Cloud.ID == "" || cfg.Cloud.Secret == "" || cfg.Cloud.AppAddress == "") {
+		if cfg.Cloud == nil || (cfg.Cloud.ID == "" || (cfg.Cloud.Secret == "" || cfg.Cloud.APIKey.IsEmpty()) || cfg.Cloud.AppAddress == "") {


Not sure what this function does and I see that we still have n.portalData.input.Secret = cloud.GetSecret() in the other file, but do we indeed want to require that both a secret and API key is present here?

Mostly wondering about the intention since it goes against how you tested connecting and we're using && in parseOpts.

I don't have a strong opinion of requiring both, but the intention was just to check that at least one of API key or secret exists in the cloud config so if secrets ever get removed this code doesn't need to be updated.

The logic in parseOpts is a bit hard to read so I might try to refactor it but that is enforcing that if one cloud config field is present then we must have a fully valid cloud config (that is, at least of API key or secret exists), but an empty cloud config is also ok. Whereas these checks enforce that we always have a complete cloud config (empty not ok), completing meaning at least one of API key or secret.

completing meaning at least one of API key or secret.

Right, I think right now we're returning an error if one is missing here. It'd have to be && for us to allow one to be missing.

Oops yeah you are right. I was thinking these if-statements were the allowable conditions not the error condition.

edobranov · 2025-12-31T21:53:27Z

subsystems/networking/definitions_linux.go

 	}

-	if cfg.Cloud.AppAddress == "" || cfg.Cloud.ID == "" || cfg.Cloud.Secret == "" {
+	if cfg.Cloud.AppAddress == "" || cfg.Cloud.ID == "" || (cfg.Cloud.Secret == "" || cfg.Cloud.APIKey.IsEmpty()) {


(same as my other question, probably gonna be the same answer)

cheukt · 2026-01-05T16:56:50Z

cmd/provisioning-client/opts.go

+	AppAddr string       `default:"https://app.viam.com:443"              description:"Cloud address to set in viam.json" long:"app-addr"`
+	PartID  string       `description:"PartID to set in viam.json"        long:"part-id"`
+	Secret  string       `description:"Device secret to set in viam.json" long:"secret"`
+	APIKey  utils.APIKey `description:"Device secret to set in viam.json" long:"api-key"`


did you test the bt provisioning flow and how did you do it?

Update agent to use API keys when they exist

b8f6c18

danielbotros force-pushed the APP-14487-update-agent-to-priortize-api-key-creds branch from 97a9c95 to b8f6c18 Compare December 31, 2025 17:58

danielbotros commented Dec 31, 2025

View reviewed changes

Rename value to key

69680a5

danielbotros changed the title ~~Update agent to use API keys when they exist~~ [APP-14487] Update viam-agent to parse and authenticate with API keys Dec 31, 2025

danielbotros requested review from cheukt, edobranov and jr22 December 31, 2025 18:44

danielbotros marked this pull request as ready for review December 31, 2025 18:44

edobranov reviewed Dec 31, 2025

View reviewed changes

Replace more value with key

701b2bf

cheukt reviewed Jan 5, 2026

View reviewed changes

Change || to &&

de34b48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[APP-14487] Update viam-agent to parse and authenticate with API keys #176

[APP-14487] Update viam-agent to parse and authenticate with API keys #176

Uh oh!

danielbotros commented Dec 29, 2025 •

edited

Loading

Uh oh!

danielbotros Dec 31, 2025 •

edited

Loading

Uh oh!

edobranov Dec 31, 2025

Uh oh!

danielbotros Dec 31, 2025

Uh oh!

edobranov Dec 31, 2025 •

edited

Loading

Uh oh!

danielbotros Dec 31, 2025

Uh oh!

edobranov Dec 31, 2025

Uh oh!

danielbotros Jan 6, 2026

Uh oh!

edobranov Dec 31, 2025

Uh oh!

cheukt Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		replace go.viam.com/rdk => ../rdk

		replace github.com/nunnatsa/ginkgolinter => github.com/nunnatsa/ginkgolinter v0.16.2

[APP-14487] Update viam-agent to parse and authenticate with API keys #176

Are you sure you want to change the base?

[APP-14487] Update viam-agent to parse and authenticate with API keys #176

Uh oh!

Conversation

danielbotros commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Uh oh!

danielbotros Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

edobranov Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

danielbotros Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

edobranov Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danielbotros Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

edobranov Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

danielbotros Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

edobranov Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

cheukt Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danielbotros commented Dec 29, 2025 •

edited

Loading

danielbotros Dec 31, 2025 •

edited

Loading

edobranov Dec 31, 2025 •

edited

Loading