fix: update templates api keys#8752
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThis change updates the configuration of API key and endpoint input fields in multiple starter project JSON files. The modifications set Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant StarterProjectComponent
participant Database
participant Environment
User->>StarterProjectComponent: Open starter project
StarterProjectComponent->>Database: Check for stored API key
alt API key found in DB
Database-->>StarterProjectComponent: Return stored API key
else API key not found
StarterProjectComponent->>Environment: Use default environment variable placeholder
end
StarterProjectComponent-->>User: Component initialized with API key (from DB or env)
Possibly related PRs
Suggested labels
Suggested reviewers
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
dosubot
Bot
added
the
size:L
github-actions
Bot
added
bug
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (4)
src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json (1)
1020-1070:update_build_configmisses syncing the env-var placeholderInside the component’s Python code (string), the provider switch only updates
display_name; it should also swap the default placeholder so templates stay in
sync with the newly-selected provider:@@ - build_config["api_key"]["display_name"] = "OpenAI API Key" + build_config["api_key"]["display_name"] = "OpenAI API Key" + build_config["api_key"]["value"] = "OPENAI_API_KEY" @@ - build_config["api_key"]["display_name"] = "Anthropic API Key" + build_config["api_key"]["display_name"] = "Anthropic API Key" + build_config["api_key"]["value"] = "ANTHROPIC_API_KEY" @@ - build_config["api_key"]["display_name"] = "Google API Key" + build_config["api_key"]["display_name"] = "Google API Key" + build_config["api_key"]["value"] = "GOOGLE_API_KEY"Without this, users must manually edit the secret every time they change provider, defeating the purpose of this PR’s automation.
src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json (1)
1740-1757: API-key placeholder is no longer updated when switching provider → wrong key will be pulled from DB
load_from_dbis correctly set totrue, but the hard-coded default value remains"OPENAI_API_KEY".
update_build_config()only tweaksdisplay_name; it never rewrites the value field.
If the user changesproviderto Anthropic or Google, the component will still try to retrieveOPENAI_API_KEY, resulting in authentication failures.Minimal patch:
@@ elif field_value == "Anthropic": build_config["model_name"]["options"] = ANTHROPIC_MODELS build_config["model_name"]["value"] = ANTHROPIC_MODELS[0] build_config["api_key"]["display_name"] = "Anthropic API Key" + build_config["api_key"]["value"] = "ANTHROPIC_API_KEY" elif field_value == "Google": build_config["model_name"]["options"] = GOOGLE_GENERATIVE_AI_MODELS build_config["model_name"]["value"] = GOOGLE_GENERATIVE_AI_MODELS[0] build_config["api_key"]["display_name"] = "Google API Key" + build_config["api_key"]["value"] = "GOOGLE_API_KEY"Without this, the new
load_from_dblogic will silently fetch the wrong secret for non-OpenAI providers.
Please update the template or the build-config mutation accordingly.src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json (1)
338-354: AssemblyAI poller is populated with the wrong env-var constant
"value": "OPENAI_API_KEY"will inject an OpenAI key into an AssemblyAI component.
Use the dedicated placeholder ("ASSEMBLY_API_KEY") to avoid authentication failures and accidental key leakage between providers.- "load_from_db": true, - "name": "api_key", - ... - "type": "str", - "value": "OPENAI_API_KEY" + "load_from_db": true, + "name": "api_key", + ... + "type": "str", + "value": "ASSEMBLY_API_KEY"src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json (1)
1388-1404:api_keyfield now loads from DB — confirm placeholder semanticsSwitching
"load_from_db"totrueand hard-coding the default value to the literal string"OPENAI_API_KEY"is on-spec with the PR goals, but double-check two things:
- At runtime the build engine must treat the string as a placeholder, not the actual key.
- If a value is found in the DB, it should override this default; some loaders prioritise the default over stored values.
If either of those assumptions is false, leave
valueempty (or use an explicit sentinel such as"__ENV__:OPENAI_API_KEY").- "value": "OPENAI_API_KEY" + "value": ""Tagging for your consideration.
♻️ Duplicate comments (5)
src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json (2)
1551-1569: Same provider-sensitive placeholder concern as above
See previous comment – the exact issue repeats for this component.
1838-1856: Same provider-sensitive placeholder concern as above
See first comment – the issue recurs here.src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json (2)
2030-2048: Same issue as above – hard-coded"OPENAI_API_KEY"The identical problem appears in this
LanguageModelComponent; see previous comment for details and proposed fix.
2321-2339: Same issue as above – hard-coded"OPENAI_API_KEY"The identical problem appears here; see the first comment for rationale and fix.
src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json (1)
2310-2326: Same issue: provider-agnostic component ships with an OpenAI placeholderSame consideration as above for the second
LanguageModelComponent.
Leaving an empty default (or provider-specific mapping in build-config) avoids mismatched placeholders when the provider changes.
🧹 Nitpick comments (16)
src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json (1)
1323-1324: Consider leaving the defaultvalueblankEven though the literal
"OPENAI_API_KEY"is only a placeholder, it will appear pre-filled in the UI and may be mistaken for a real key. An empty default keeps users from accidentally saving a non-functional value.- "value": "OPENAI_API_KEY" + "value": ""src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json (1)
1265-1282: Default key placeholder should adapt to provider changesHard-coding
"value": "OPENAI_API_KEY"works for the default OpenAI provider but becomes misleading once the user switches the component to Anthropic or Google.update_build_config()already updates thedisplay_nameof theapi_keyfield whenproviderchanges; consider updating thevalueas well (e.g., toANTHROPIC_API_KEYorGOOGLE_API_KEY) so that:
- Docs/tooltips stay consistent with the active provider.
- Users aren’t tempted to paste the wrong secret into the wrong env var slot.
An illustrative tweak inside
update_build_config:@@ if field_name == "provider": if field_value == "OpenAI": + build_config["api_key"]["value"] = "OPENAI_API_KEY" elif field_value == "Anthropic": + build_config["api_key"]["value"] = "ANTHROPIC_API_KEY" elif field_value == "Google": + build_config["api_key"]["value"] = "GOOGLE_API_KEY"This keeps the starter project templates self-documenting across providers.
src/backend/base/langflow/initial_setup/starter_projects/Search agent.json (2)
137-146: Verify that the new placeholder won't be sent as a literal API key
load_from_dbwas flipped totrueand the default value was changed to the string"SCRAPEGRAPH_API_KEY".
Double-check that your runtime replaces this placeholder (or pulls the secret from the DB) before the component constructs thesgai_client. Otherwise the request will carry the literal string and fail authentication.Minor polish (optional):
- "placeholder": "", + "placeholder": "SCRAPEGRAPH_API_KEY",This keeps the UI consistent with the default value.
1108-1118: Same concern for the Agent’s OpenAI keyThe Agent component now defaults to
"OPENAI_API_KEY"withload_from_db: true.
Please confirm:
- The global secret exists under that exact name.
- The backend replaces / injects the real key at execution time, not leaving the literal placeholder.
Optional UI tweak for consistency:
- "placeholder": "", + "placeholder": "OPENAI_API_KEY",src/backend/base/langflow/initial_setup/starter_projects/Social Media Agent.json (1)
1408-1424: Verify placeholder syntax for automatic API-key injection
"load_from_db": trueis now paired with the literal string"OPENAI_API_KEY".
Before merging, double-check that the Langflow loader treats an un-wrapped token (no${…}/{{…}}) as the environment-variable key. If the runtime expects a different placeholder format, this may silently fall back to an empty string.Minor: the on-canvas “💡 Add your OpenAI API key here” notes might be misleading now that the key is pulled automatically—consider updating or removing them for clarity.
src/backend/base/langflow/initial_setup/starter_projects/Market Research.json (2)
1193-1210: API key field correctly wired to env/DB – consider adding a placeholder for UX clarity
load_from_dbis nowtrueand the default value is the env-var sentinelTAVILY_API_KEY, which aligns with the new template strategy.
Minor nit: leaving"placeholder": ""means the UI shows a blank input. Setting the same sentinel as a placeholder would hint the user what will be fetched.- "placeholder": "", + "placeholder": "TAVILY_API_KEY",
2157-2173: Agent component aligned – but value is always “OPENAI_API_KEY” even for non-OpenAI providersWhen the user later flips
agent_llmto Anthropic/Google/Groq, the sentinel will still readOPENAI_API_KEY.
The provider-switching logic already mutatesdisplay_name; you might also want to swap the defaultvalueaccordingly to avoid confusion.- "value": "OPENAI_API_KEY" + "value": "ANTHROPIC_API_KEY" # if provider == "Anthropic" + "value": "GOOGLE_API_KEY" # if provider == "Google Generative AI"If that dynamic substitution is handled elsewhere, feel free to skip.
src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json (3)
788-804: Default API-key placeholder may be mistaken for a real secret
"value": "TAVILY_API_KEY"is hard-coded as the secret’s value.
Withload_from_db: true, an unset DB value would fall back to this literal and the component would attempt to call Tavily with the stringTAVILY_API_KEY, producing 401s that are hard to diagnose.Consider leaving
valueempty (or using a clearly invalid sentinel such as"") and rely exclusively on the DB / env loader:- "load_from_db": true, - ... - "value": "TAVILY_API_KEY" + "load_from_db": true, + ... + "value": ""This avoids accidental misuse while still advertising the required env var in docs / notes.
1186-1202: Same placeholder issue as above for AgentQLThe literal
"AGENTQL_API_KEY"will be sent to AgentQL if the key isn’t found in the DB.
Adopt the same safe pattern (empty string or explicit sentinel) to prevent silent auth failures.
1747-1763: OpenAI secret placeholder should be blank to avoid failed callsFor consistency and to avoid leaking a dummy value to the OpenAI client, prefer:
- "value": "OPENAI_API_KEY" + "value": ""Down-stream logic can still fetch
OPENAI_API_KEYfrom env whenload_from_dbis true.src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json (1)
892-902:api_keyplaceholder should adapt when the provider changesThe default value
"OPENAI_API_KEY"makes sense for the default provider, butAgentComponent.update_build_config()only updates the field’s display_name, not itsvalue.
If a user switches the provider to Anthropic or Google, the stale placeholder will still be"OPENAI_API_KEY"andChatAnthropic/ChatGoogleGenerativeAIwill receive the wrong secret.Consider extending
update_build_config()to switch the placeholder string as well, e.g.:- build_config["api_key"]["display_name"] = "Anthropic API Key" + build_config["api_key"]["display_name"] = "Anthropic API Key" + build_config["api_key"]["value"] = "ANTHROPIC_API_KEY"src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json (2)
2183-2199: OpenAI key now pulled from DB – confirm behaviour for non-OpenAI providersAgent defaults to the OpenAI provider, so
"OPENAI_API_KEY"as the default value is fine.
However, if a user later switchesagent_llmto Anthropic/Google in the UI,update_build_configonly updatesdisplay_name; it does not overwrite thevaluefield, so the stale"OPENAI_API_KEY"string will still be sent.Consider updating
update_build_configto refresh the defaultvaluewhen the provider changes, or leavevalueblank so that each provider inserts its own default.
2648-2664: LanguageModelComponent default key updatedSame observation as above: the template now correctly loads
OPENAI_API_KEYfrom DB, but if the user changesproviderto Anthropic/Google thevaluewill stay as"OPENAI_API_KEY".
Worth ensuring the dynamic build-config logic also resets thevaluefor a smoother UX.src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json (1)
2018-2034: Hard-codedOPENAI_API_KEYdefault limits multi-provider supportThe default value is always
"OPENAI_API_KEY".
When the user switches the provider to Anthropic or Google, the UI will still pre-populate the OpenAI key placeholder, which can be confusing.- "value": "OPENAI_API_KEY" + "value": ""Let the provider-specific
update_build_configlogic inject the right placeholder instead of baking one in up-front.src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json (1)
1945-1962: Agent components now referenceOPENAI_API_KEYAll three agent templates (City Selection, Local Expert, Travel Concierge) now default their
api_keyinput to the globalOPENAI_API_KEY, keepingload_from_db: true.
This removes the need for manual entry and aligns with the new convention.Only caveat: if a user later switches the provider dropdown (
agent_llm) to Anthropic/Groq/etc. they must also update the key value accordingly. The dynamic-update logic inupdate_build_configshould handle that, but worth a quick click-test in the UI.Consider adding a short tooltip/hint to the field description reminding users that the key value must match the chosen provider when they deviate from “OpenAI”.
Also applies to: 2489-2506, 3033-3050
src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json (1)
768-773: Update help text to match new behaviourThe note still instructs users to paste their key in the Agent component, but they now supply it via env / DB. Re-word to “Ensure your
OPENAI_API_KEYis configured in Settings” to avoid confusion.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (26)
src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json(6 hunks)src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Custom Component Maker.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json(7 hunks)src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Market Research.json(5 hunks)src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json(7 hunks)src/backend/base/langflow/initial_setup/starter_projects/News Aggregator.json(3 hunks)src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json(4 hunks)src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json(7 hunks)src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/SEO Keyword Generator.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/SaaS Pricing.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Search agent.json(3 hunks)src/backend/base/langflow/initial_setup/starter_projects/Sequential Tasks Agents.json(4 hunks)src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json(1 hunks)src/backend/base/langflow/initial_setup/starter_projects/Social Media Agent.json(2 hunks)src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json(6 hunks)src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json(4 hunks)src/backend/base/langflow/initial_setup/starter_projects/Twitter Thread Generator.json(1 hunks)src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json(4 hunks)src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json(5 hunks)
🧰 Additional context used
🧠 Learnings (25)
📓 Common learnings
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Twitter Thread Generator.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Social Media Agent.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/SaaS Pricing.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/News Aggregator.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Market Research.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/SEO Keyword Generator.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Search agent.json (1)
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
src/backend/base/langflow/initial_setup/starter_projects/Custom Component Maker.json (2)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/icons.mdc:0-0
Timestamp: 2025-06-23T12:46:54.855Z
Learning: When implementing a new component icon in Langflow, ensure the icon name used in the backend Python 'icon' attribute matches exactly (case-sensitive) with the frontend icon mapping and lazy import key.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Sequential Tasks Agents.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json (1)
undefined
<retrieved_learning>
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/backend_development.mdc:0-0
Timestamp: 2025-06-23T12:46:23.863Z
Learning: Starter project files are auto-formatted after running 'langflow run'; these formatting changes can be committed or ignored as needed.
</retrieved_learning>
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Label PR
🔇 Additional comments (32)
src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json (1)
1094-1110: Confirm env-var resolution – literal"OPENAI_API_KEY"may be interpreted as an actual secret value
load_from_dbis set totrue, so the front-end/back-end logic must treat the string invalueas the name of the variable to pull from secure storage (or the environment).
Please double-check that the resolution code expects exactly"OPENAI_API_KEY"(without${…}or other delimiters). If it expects a different token format, users might end up with the literal string"OPENAI_API_KEY"being persisted or sent to the provider, breaking requests and potentially leaking confusion into logs.If the resolver does require
${VAR}style tokens, update accordingly:- "value": "OPENAI_API_KEY" + "value": "${OPENAI_API_KEY}"src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json (1)
957-974: ```shell
#!/bin/bashLocate the JSON file
echo "File path:"
find src -type f | grep "Basic Prompting.json"Show context around the api_key definition
echo -e "\nContext around lines 940-1000:"
sed -n '940,1000p' src/backend/base/langflow/initial_setup/starter_projects/Basic\ Prompting.json</details> <details> <summary>src/backend/base/langflow/initial_setup/starter_projects/SaaS Pricing.json (1)</summary> `991-1008`: **API-key field now correctly uses `load_from_db`; looks good** The switch to ```json "load_from_db": true, "value": "OPENAI_API_KEY"aligns with the PR objective of centralising secrets and removes the need for users to paste keys into every starter project. No functional or security regressions spotted—the field still remains
"password": true, so the value won’t be exposed in the UI.src/backend/base/langflow/initial_setup/starter_projects/SEO Keyword Generator.json (2)
939-949: Good move enablingload_from_dbSwitching
load_from_dbtotrueand injecting theOPENAI_API_KEYplaceholder removes manual entry friction and standardises secret handling across templates. 👍
931-949: ```shell
#!/bin/bash
set -eecho "Searching for update_build_config across the repo"
rg -n "update_build_config" -A5 -B5echo -e "\nShowing JSON snippet around update_build_config in the SEO Keyword Generator JSON"
rg -n "update_build_config" "src/backend/base/langflow/initial_setup/starter_projects/SEO Keyword Generator.json" -A10 -B10</details> <details> <summary>src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json (1)</summary> `1314-1315`: **`load_from_db` flag correctly enabled** Switching `"load_from_db"` to `true` ensures the key is pulled from the secrets store instead of the (editable) JSON. Matches the PR objective—no issues spotted. </details> <details> <summary>src/backend/base/langflow/initial_setup/starter_projects/Twitter Thread Generator.json (1)</summary> `1897-1914`: To confirm whether the `value` field is set for `api_key`, let’s dump a larger context around its definition: ```shell #!/bin/bash set -e # Show 15 lines before and after the api_key block to verify the "value" key rg -n -C15 '"name": "api_key"' src/backend/base/langflow/initial_setup/starter_projects/Twitter\ Thread\ Generator.jsonsrc/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json (1)
1393-1410: Hard-coding the placeholder toOPENAI_API_KEYbreaks cross-provider flows
"value": "OPENAI_API_KEY"works only while the provider remains OpenAI.
If the user flipsproviderto Anthropic or Google, the field keeps loadingOPENAI_API_KEY, so:
ChatAnthropic/ChatGoogleGenerativeAIwill receive the wrong secret.- Users who previously relied on an empty placeholder to notice “I must enter a key” will no longer get that hint.
A minimal fix is to reset the value whenever the provider changes:
@@ elif field_value == "Anthropic": build_config["model_name"]["options"] = ANTHROPIC_MODELS build_config["model_name"]["value"] = ANTHROPIC_MODELS[0] build_config["api_key"]["display_name"] = "Anthropic API Key" + build_config["api_key"]["value"] = "ANTHROPIC_API_KEY" elif field_value == "Google": build_config["model_name"]["options"] = GOOGLE_GENERATIVE_AI_MODELS build_config["model_name"]["value"] = GOOGLE_GENERATIVE_AI_MODELS[0] build_config["api_key"]["display_name"] = "Google API Key" + build_config["api_key"]["value"] = "GOOGLE_API_KEY"Alternatively, keep the value empty and rely solely on
load_from_db: true:- "value": "OPENAI_API_KEY" + "value": ""Either approach prevents accidental key mix-ups across providers.
Please confirm the intended behaviour of
load_from_dband whether multi-provider templates are expected to work out-of-the-box.src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json (2)
389-407: API key placeholder correctly updatedThe
"value"forapi_keyis now set to"ANTHROPIC_API_KEY"whileload_from_dbremainstrue.
This aligns with the PR goal of referencing the global environment/API-key store and avoids shipping real credentials. No issues spotted.
729-746: Second Anthropic node kept in syncSame change applied to the second Anthropic model instance, maintaining consistency across nodes. Looks good.
src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json (1)
1266-1275: API-endpoint field correctly converted to env-based loading
load_from_dbis nowtrueand the defaultvalueis the env placeholderASTRA_DB_API_ENDPOINT.
This mirrors the new convention applied across the templates and removes hard-coded endpoints – nice.No functional or security concerns detected here.
src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json (1)
3440-3449: Double-check precedence betweenload_from_dband non-emptyvalue
"load_from_db": truesignals the UI/runtime to fetch the secret from secure storage, but a hard-coded fallback"value": "ASTRA_DB_API_ENDPOINT"is now provided as well.
Please confirm that:
- The loader ignores the
valuefield whenload_from_dbistrue(or vice-versa you actually want this string to be persisted if the secret is missing)."ASTRA_DB_API_ENDPOINT"exactly matches the name used by the secrets backend; a typo here will silently break look-ups.If the runtime uses the first non-empty value it sees, consider leaving
"value"empty to avoid accidentally exposing / persisting the placeholder.Also applies to: 4201-4210
src/backend/base/langflow/initial_setup/starter_projects/News Aggregator.json (2)
230-239: Ensure placeholdervalueis compatible with the “load_from_db” mechanism
"load_from_db": truemeans the UI/engine will attempt to pull the secret from the user-level credentials store.
If that lookup fails, the literal"value"field is used as a fallback. Shipping the hard-coded stringAGENTQL_API_KEYcould propagate unchanged to the runtime and cause authentication failures.Please double-check that:
- The settings subsystem treats
AGENTQL_API_KEYas a macro / env-var reference rather than a literal.- No other starter projects rely on a different placeholder syntax (e.g.
${AGENTQL_API_KEY}or{{AGENTQL_API_KEY}}) – keep it consistent.If the engine expects an empty string when the key is not found, consider reverting the
"value"to""(or the engine’s documented sentinel).
1480-1490: Same fallback concern for OpenAI key
"value": "OPENAI_API_KEY"follows the same pattern. Verify that the runtime expands or replaces this token instead of forwarding it verbatim to OpenAI.Consistency tip: update the field’s
infotext (currently “The OpenAI API Key …”) to mention that the global key will be used automatically when left blank, so users understand the new behaviour.src/backend/base/langflow/initial_setup/starter_projects/Custom Component Maker.json (1)
2621-2638: API key field correctly migrated, but confirm runtime support forload_from_dbonSecretStrInput.Switching
load_from_dbtotrueand seeding the field with theANTHROPIC_API_KEYplaceholder aligns with the new template-wide convention.
Please double-check that:
SecretStrInputinstances withload_from_db: trueare actually fetched from the credentials store at runtime (some older helpers only handledStrInput).- The backend recognises
ANTHROPIC_API_KEYas the canonical global secret name (case-sensitive).If both conditions are already covered, no further action is required.
src/backend/base/langflow/initial_setup/starter_projects/Market Research.json (2)
1784-1801: Language-model API key update looks good – double-check optional/required interplayGood job switching to
OPENAI_API_KEYwithload_from_db: true.
Becauserequiredis stillfalse, an unset env-var silently yields an empty key and can surface only at runtime. If that’s intentional, ignore; otherwise consider keepingrequired: trueto fail fast.
1-1: Verify no leftoverapi_keyfields still useload_from_db: falseTo ensure full coverage across starter projects, run:
#!/bin/bash # Find api_key fields that weren’t flipped to load_from_db=true rg -n '"name":\s*"api_key"' --json | jq -r '.data.path.text' | \ while read -r file; do rg -n -A2 -B2 '"name":\s*"api_key"' "$file" | \ grep -A1 '"load_from_db": false' && echo "⚠️ $file" doneYou should expect no output. Any listed file still needs updating.
src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json (2)
585-594: Confirm that the placeholder is resolved at runtime
load_from_dbis nowtrueandvalueis set to the literal stringYOUTUBE_API_KEY.
Please double-check that the backend/template loader actually substitutes this literal with the real secret (env var / DB value). If the substitution layer is missing or mis-configured, the Google API client will end up receiving the string"YOUTUBE_API_KEY"and all requests will fail with 401s.
2926-2936: Same runtime-substitution caveat forLanguageModelComponentAs above, ensure that:
- A literal
"OPENAI_API_KEY"never reaches the SDK.- When the user flips
providerto Anthropic / Google, the placeholder updates (or is ignored) accordingly.A quick safeguard could be to raise a validation error if
api_keystill equals the provider-mismatched placeholder at build time.src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json (3)
2466-2483: Creator component updated correctly
AssemblyAITranscriptionJobCreatornow points toASSEMBLY_API_KEYand persists the secret viaload_from_db: true.
Good alignment with the PR objective.
3046-3063: OpenAI model component update looks good
LanguageModelComponent-cPCaHcorrectly switches toload_from_db: truewith theOPENAI_API_KEYplaceholder.
3340-3358: Duplicate OpenAI model component update looks goodSecond
LanguageModelComponentinstance mirrors the same, no further action needed.src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json (2)
1687-1703: Consistent switch to globalTAVILY_API_KEYlooks good
load_from_dbis enabled and the placeholder is now the env-style string, keeping secrets out of the template.
No functional, security, or UX concerns spotted here.
2940-2956: Duplicate adjustment for second LLM node – looks consistentChange mirrors the previous LanguageModelComponent. No additional issues.
src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json (2)
1291-1307: Confirmload_from_db=true, but double-check therequiredflagGood to see the Tavily API key now resolved from the secrets store rather than hard-coding.
However, with"required": truethe flow cannot be saved/run unless a secret namedTAVILY_API_KEYalready exists.
That is probably intended, but if the goal is to let users decide later, set"required": false.No action needed if the strict requirement is deliberate.
2681-2697: Agent component: placeholder OK, but considerrequiredvs secrets store
load_from_dbis nowtrueand"value": "OPENAI_API_KEY"which is fine.
Just make sure the secret name matches your secrets table exactly; otherwise the “required” flag will block execution.No code change requested.
src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json (1)
1596-1612: Switched Search API key to global placeholder – looks goodThe field now
- sets
load_from_dbtotrue- defaults to
"SEARCHAPI_API_KEY"This exactly matches the PR objective and removes hard-coded secrets inside the template.
No functional or security issues spotted.Please double–check that
SEARCHAPI_API_KEYis present in the platform’s env-var / secrets store so flows created from this template work out-of-the-box.src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json (1)
1375-1392: API key field now auto-binds to stored secret – looks goodFlipping
load_from_dbtotrueand pre-filling"OPENAI_API_KEY"makes the component work out-of-the-box without exposing credentials. No issues spotted.src/backend/base/langflow/initial_setup/starter_projects/Sequential Tasks Agents.json (4)
472-489: Check whether using"OPENAI_API_KEY"as a literal default may be misleadingSetting the default
valueto the literal placeholder string means this exact text will be persisted in the DB the first time the template is saved.
End-users who forget to replace it will silently send that placeholder downstream and hit authentication errors that are hard to diagnose.- "value": "OPENAI_API_KEY" + "value": ""With
load_from_db: truealready in place, an empty default is enough – the component will still resolve the real key from the secrets table / env.
[ suggest_optional_refactor ][ request_verification ]
1023-1040: Apply the same placeholder-removal rationale hereSame comment as above for the “Analysis & Editor Agent”. Saving the literal placeholder makes debugging harder.
- "value": "OPENAI_API_KEY" + "value": ""[ suggest_optional_refactor ][ duplicate_comment ]
2404-2421: Ditto for “Researcher Agent”For consistency (and to avoid persisting dummy data) the
api_key.valueshould be left blank.- "value": "OPENAI_API_KEY" + "value": ""[ suggest_optional_refactor ][ duplicate_comment ]
3291-3307: Good: addedload_from_db; but re-evaluate default value👍 Enabling
load_from_dbis the right move.
However, persisting"TAVILY_API_KEY"as the default may create the same confusion as with the OpenAI keys.- "value": "TAVILY_API_KEY" + "value": ""If you still want to hint the expected env-var name in the UI, consider adding a
placeholderinstead of a persistedvalue.
[ suggest_optional_refactor ][ request_verification ]
…ng Summary.json Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com>
…ng Summary.json Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com>
github-actions
Bot
added
bug
github-actions
Bot
added
lgtm
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
github-actions
Bot
added
bug
github-actions
Bot
added
bug
ogabrielluiz
added
lgtm
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
github-actions
Bot
added
bug
* update templates api keys * Update src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> * Update src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> * Update Text Sentiment Analysis.json * cust comp test fix --------- Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: Mike Fortman <michael.fortman@datastax.com>
* update templates api keys * Update src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> * Update src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> * Update Text Sentiment Analysis.json * cust comp test fix --------- Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: Mike Fortman <michael.fortman@datastax.com>
5 participants
All occurrences should be replaced with the corresponding company’s global API key variable. For example:
OpenAI → OPENAI_API_KEY
Anthropic → ANTHROPIC_API_KEY
For Astra fields:
"name": "api_endpoint" → ASTRA_DB_API_ENDPOINT
"name": "token" → ASTRA_DB_APPLICATION_TOKEN
Turn the field "load_from_db": true on those fields
Summary by CodeRabbit