feat(web search): normalize search provider secret precedence to match inference providers (#6036)

Search tools previously used config-key > provider-data-key precedence,
whereas inference providers use provider-data-key > config-key. This
breaks multi-tenant patterns where provider data should override config.

Normalize the following search providers (brave, bing, tavily) to match
inference provider behavior: provider data key always overrides config
key, both are optional, and _get_api_key() returns None when neither is
set.

Add TestProviderDataApiKeyOverride test classes to bing, brave, and
tavily.

Signed-off-by: Matthew Farrellee <matt@cs.wisc.edu>

Author: mattf

docs/docs/providers/tool_runtime/remote_bing-search.mdx

@@ -16,7 +16,7 @@ Bing Search tool for web search capabilities using Microsoft's search engine.
 |-------|------|----------|---------|-------------|
 | `timeout` | `float` | No | 30.0 | Overall HTTP timeout in seconds for requests to external services. |
 | `connect_timeout` | `float` | No | 10.0 | TCP connect timeout in seconds. Shorter than the overall timeout to fail fast on unreachable hosts. |
-| `api_key` | `SecretStr \| None` | No |  |  |
+| `api_key` | `SecretStr \| None` | No |  | The Bing Search API Key. Can be overridden per-request via X-OGX-Provider-Data header. |
 | `top_k` | `int` | No | 3 |  |
 
 ## Sample Configuration

docs/docs/providers/tool_runtime/remote_brave-search.mdx

@@ -16,7 +16,7 @@ Brave Search tool for web search capabilities with privacy-focused results.
 |-------|------|----------|---------|-------------|
 | `timeout` | `float` | No | 30.0 | Overall HTTP timeout in seconds for requests to external services. |
 | `connect_timeout` | `float` | No | 10.0 | TCP connect timeout in seconds. Shorter than the overall timeout to fail fast on unreachable hosts. |
-| `api_key` | `SecretStr \| None` | No |  | The Brave Search API Key |
+| `api_key` | `SecretStr \| None` | No |  | The Brave Search API Key. Can be overridden per-request via X-OGX-Provider-Data header. |
 | `max_results` | `int` | No | 3 | The maximum number of results to return |
 
 ## Sample Configuration

docs/docs/providers/tool_runtime/remote_tavily-search.mdx

@@ -16,7 +16,7 @@ Tavily Search tool for AI-optimized web search with structured results.
 |-------|------|----------|---------|-------------|
 | `timeout` | `float` | No | 30.0 | Overall HTTP timeout in seconds for requests to external services. |
 | `connect_timeout` | `float` | No | 10.0 | TCP connect timeout in seconds. Shorter than the overall timeout to fail fast on unreachable hosts. |
-| `api_key` | `SecretStr \| None` | No |  | The Tavily Search API Key |
+| `api_key` | `SecretStr \| None` | No |  | The Tavily Search API Key. Can be overridden per-request via X-OGX-Provider-Data header. |
 | `max_results` | `int` | No | 3 | The maximum number of results to return |
 
 ## Sample Configuration

src/ogx/providers/remote/tool_runtime/bing_search/bing_search.py

@@ -47,16 +47,14 @@ async def register_toolgroup(self, toolgroup: ToolGroup) -> None:
     async def unregister_toolgroup(self, toolgroup_id: str) -> None:
         return
 
-    def _get_api_key(self) -> str:
-        if self.config.api_key:
-            return self.config.api_key.get_secret_value()
+    def _get_api_key(self) -> str | None:
+        api_key = self.config.api_key.get_secret_value() if self.config.api_key else None
 
         provider_data = self.get_request_provider_data()
-        if provider_data is None or not provider_data.bing_search_api_key:
-            raise ValueError(
-                'Pass Bing Search API Key in the header X-OGX-Provider-Data as { "bing_search_api_key": <your api key>}'
-            )
-        return provider_data.bing_search_api_key.get_secret_value()
+        if provider_data and provider_data.bing_search_api_key:
+            api_key = provider_data.bing_search_api_key.get_secret_value()
+
+        return api_key
 
     async def list_runtime_tools(
         self,
@@ -87,9 +85,9 @@ async def invoke_tool(
         self, tool_name: str, kwargs: dict[str, Any], authorization: str | None = None
     ) -> ToolInvocationResult:
         api_key = self._get_api_key()
-        headers = {
-            "Ocp-Apim-Subscription-Key": api_key,
-        }
+        headers: dict[str, str] = {}
+        if api_key:
+            headers["Ocp-Apim-Subscription-Key"] = api_key
 
         query = kwargs["query"]
 

src/ogx/providers/remote/tool_runtime/bing_search/config.py

@@ -6,15 +6,18 @@
 
 from typing import Any
 
-from pydantic import SecretStr
+from pydantic import Field, SecretStr
 
 from ogx.providers.utils.common.http import BaseToolRuntimeConfig
 
 
 class BingSearchToolConfig(BaseToolRuntimeConfig):
     """Configuration for Bing Search Tool Runtime"""
 
-    api_key: SecretStr | None = None
+    api_key: SecretStr | None = Field(
+        default=None,
+        description="The Bing Search API Key. Can be overridden per-request via X-OGX-Provider-Data header.",
+    )
     top_k: int = 3
 
     @classmethod

src/ogx/providers/remote/tool_runtime/brave_search/brave_search.py

@@ -39,16 +39,14 @@ async def register_toolgroup(self, toolgroup: ToolGroup) -> None:
     async def unregister_toolgroup(self, toolgroup_id: str) -> None:
         return
 
-    def _get_api_key(self) -> str:
-        if self.config.api_key:
-            return self.config.api_key.get_secret_value()
+    def _get_api_key(self) -> str | None:
+        api_key = self.config.api_key.get_secret_value() if self.config.api_key else None
 
         provider_data = self.get_request_provider_data()
-        if provider_data is None or not provider_data.brave_search_api_key:
-            raise ValueError(
-                'Pass Search provider\'s API Key in the header X-OGX-Provider-Data as { "brave_search_api_key": <your api key>}'
-            )
-        return provider_data.brave_search_api_key.get_secret_value()
+        if provider_data and provider_data.brave_search_api_key:
+            api_key = provider_data.brave_search_api_key.get_secret_value()
+
+        return api_key
 
     async def list_runtime_tools(
         self,
@@ -80,11 +78,12 @@ async def invoke_tool(
     ) -> ToolInvocationResult:
         api_key = self._get_api_key()
         url = "https://api.search.brave.com/res/v1/web/search"
-        headers = {
-            "X-Subscription-Token": api_key,
+        headers: dict[str, str] = {
             "Accept-Encoding": "gzip",
             "Accept": "application/json",
         }
+        if api_key:
+            headers["X-Subscription-Token"] = api_key
 
         query = kwargs["query"]
 

src/ogx/providers/remote/tool_runtime/brave_search/config.py

@@ -16,7 +16,7 @@ class BraveSearchToolConfig(BaseToolRuntimeConfig):
 
     api_key: SecretStr | None = Field(
         default=None,
-        description="The Brave Search API Key",
+        description="The Brave Search API Key. Can be overridden per-request via X-OGX-Provider-Data header.",
     )
     max_results: int = Field(
         default=3,

src/ogx/providers/remote/tool_runtime/tavily_search/config.py

@@ -16,7 +16,7 @@ class TavilySearchToolConfig(BaseToolRuntimeConfig):
 
     api_key: SecretStr | None = Field(
         default=None,
-        description="The Tavily Search API Key",
+        description="The Tavily Search API Key. Can be overridden per-request via X-OGX-Provider-Data header.",
     )
     max_results: int = Field(
         default=3,

src/ogx/providers/remote/tool_runtime/tavily_search/tavily_search.py

@@ -46,16 +46,14 @@ async def register_toolgroup(self, toolgroup: ToolGroup) -> None:
     async def unregister_toolgroup(self, toolgroup_id: str) -> None:
         return
 
-    def _get_api_key(self) -> str:
-        if self.config.api_key:
-            return self.config.api_key.get_secret_value()
+    def _get_api_key(self) -> str | None:
+        api_key = self.config.api_key.get_secret_value() if self.config.api_key else None
 
         provider_data = self.get_request_provider_data()
-        if provider_data is None or not provider_data.tavily_search_api_key:
-            raise ValueError(
-                'Pass Search provider\'s API Key in the header X-OGX-Provider-Data as { "tavily_search_api_key": <your api key>}'
-            )
-        return provider_data.tavily_search_api_key.get_secret_value()
+        if provider_data and provider_data.tavily_search_api_key:
+            api_key = provider_data.tavily_search_api_key.get_secret_value()
+
+        return api_key
 
     async def list_runtime_tools(
         self,
@@ -87,9 +85,10 @@ async def invoke_tool(
     ) -> ToolInvocationResult:
         api_key = self._get_api_key()
         request_body: dict[str, Any] = {
-            "api_key": api_key,
             "query": kwargs["query"],
         }
+        if api_key:
+            request_body["api_key"] = api_key
 
         allowed_domains = kwargs.get("allowed_domains")
         if allowed_domains: