feat: add requires_auth flag for custom providers without authentication

crates/goose-cli/src/commands/configure.rs

@@ -5,7 +5,9 @@ use goose::agents::extension::ToolInfo;
 use goose::agents::extension_manager::get_parameter_names;
 use goose::agents::Agent;
 use goose::agents::{extension::Envs, ExtensionConfig};
-use goose::config::declarative_providers::{create_custom_provider, remove_custom_provider};
+use goose::config::declarative_providers::{
+    create_custom_provider, remove_custom_provider, CreateCustomProviderParams,
+};
 use goose::config::extensions::{
     get_all_extension_names, get_all_extensions, get_enabled_extensions, get_extension_by_name,
     name_to_key, remove_extension, set_extension, set_extension_enabled,
@@ -1877,11 +1879,16 @@ fn add_provider() -> anyhow::Result<()> {
         })
         .interact()?;
 
-    let api_key: String = cliclack::password("API key:")
-        .allow_empty()
-        .mask('▪')
+    let requires_auth = cliclack::confirm("Does this provider require authentication?")
+        .initial_value(true)
         .interact()?;
 
+    let api_key: String = if requires_auth {
+        cliclack::password("API key:").mask('▪').interact()?
+    } else {
+        String::new()
+    };
+
     let models_input: String = cliclack::input("Available models (separate with commas):")
         .placeholder("model-a, model-b, model-c")
         .validate(|input: &String| {
@@ -1910,15 +1917,16 @@ fn add_provider() -> anyhow::Result<()> {
         None
     };
 
-    create_custom_provider(
-        provider_type,
-        display_name.clone(),
+    create_custom_provider(CreateCustomProviderParams {
+        engine: provider_type.to_string(),
+        display_name: display_name.clone(),
         api_url,
         api_key,
         models,
-        Some(supports_streaming),
+        supports_streaming: Some(supports_streaming),
         headers,
-    )?;
+        requires_auth,
+    })?;
 
     cliclack::outro(format!("Custom provider added: {}", display_name))?;
     Ok(())

crates/goose-server/src/routes/config_management.rs

@@ -95,6 +95,12 @@ pub struct UpdateCustomProviderRequest {
     pub models: Vec<String>,
     pub supports_streaming: Option<bool>,
     pub headers: Option<std::collections::HashMap<String, String>>,
+    #[serde(default = "default_requires_auth")]
+    pub requires_auth: bool,
+}
+
+fn default_requires_auth() -> bool {
+    true
 }
 
 #[derive(Deserialize, ToSchema)]
@@ -708,13 +714,16 @@ pub async fn create_custom_provider(
     Json(request): Json<UpdateCustomProviderRequest>,
 ) -> Result<Json<String>, StatusCode> {
     let config = goose::config::declarative_providers::create_custom_provider(
-        &request.engine,
-        request.display_name,
-        request.api_url,
-        request.api_key,
-        request.models,
-        request.supports_streaming,
-        request.headers,
+        goose::config::declarative_providers::CreateCustomProviderParams {
+            engine: request.engine,
+            display_name: request.display_name,
+            api_url: request.api_url,
+            api_key: request.api_key,
+            models: request.models,
+            supports_streaming: request.supports_streaming,
+            headers: request.headers,
+            requires_auth: request.requires_auth,
+        },
     )
     .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
 
@@ -778,13 +787,17 @@ pub async fn update_custom_provider(
     Json(request): Json<UpdateCustomProviderRequest>,
 ) -> Result<Json<String>, StatusCode> {
     goose::config::declarative_providers::update_custom_provider(
-        &id,
-        &request.engine,
-        request.display_name,
-        request.api_url,
-        request.api_key,
-        request.models,
-        request.supports_streaming,
+        goose::config::declarative_providers::UpdateCustomProviderParams {
+            id: id.clone(),
+            engine: request.engine,
+            display_name: request.display_name,
+            api_url: request.api_url,
+            api_key: request.api_key,
+            models: request.models,
+            supports_streaming: request.supports_streaming,
+            headers: request.headers,
+            requires_auth: request.requires_auth,
+        },
     )
     .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
 

crates/goose-server/src/routes/utils.rs

@@ -96,9 +96,20 @@ pub fn check_provider_configured(metadata: &ProviderMetadata, provider_type: Pro
 
     if provider_type == ProviderType::Custom || provider_type == ProviderType::Declarative {
         if let Ok(loaded_provider) = load_provider(metadata.name.as_str()) {
-            return config
-                .get_secret::<String>(&loaded_provider.config.api_key_env)
-                .is_ok();
+            if !loaded_provider.config.requires_auth {
+                return true;
+            }
+
+            if !loaded_provider.config.api_key_env.is_empty() {
+                let api_key_result =
+                    config.get_secret::<String>(&loaded_provider.config.api_key_env);
+                if api_key_result.is_ok() {
+                    return true;
+                }
+            }
+
+            // Custom providers with config files are intentionally created
+            return provider_type == ProviderType::Custom;
         }
     }
 

crates/goose/src/config/declarative_providers.rs

@@ -33,12 +33,19 @@ pub struct DeclarativeProviderConfig {
     pub engine: ProviderEngine,
     pub display_name: String,
     pub description: Option<String>,
+    #[serde(default)]
     pub api_key_env: String,
     pub base_url: String,
     pub models: Vec<ModelInfo>,
     pub headers: Option<HashMap<String, String>>,
     pub timeout_seconds: Option<u64>,
     pub supports_streaming: Option<bool>,
+    #[serde(default = "default_requires_auth")]
+    pub requires_auth: bool,
+}
+
+fn default_requires_auth() -> bool {
+    true
 }
 
 impl DeclarativeProviderConfig {
@@ -85,42 +92,68 @@ pub fn generate_api_key_name(id: &str) -> String {
     format!("{}_API_KEY", id.to_uppercase())
 }
 
+#[derive(Debug, Clone)]
+pub struct CreateCustomProviderParams {
+    pub engine: String,
+    pub display_name: String,
+    pub api_url: String,
+    pub api_key: String,
+    pub models: Vec<String>,
+    pub supports_streaming: Option<bool>,
+    pub headers: Option<HashMap<String, String>>,
+    pub requires_auth: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct UpdateCustomProviderParams {
+    pub id: String,
+    pub engine: String,
+    pub display_name: String,
+    pub api_url: String,
+    pub api_key: String,
+    pub models: Vec<String>,
+    pub supports_streaming: Option<bool>,
+    pub headers: Option<HashMap<String, String>>,
+    pub requires_auth: bool,
+}
+
 pub fn create_custom_provider(
-    engine: &str,
-    display_name: String,
-    api_url: String,
-    api_key: String,
-    models: Vec<String>,
-    supports_streaming: Option<bool>,
-    headers: Option<HashMap<String, String>>,
+    params: CreateCustomProviderParams,
 ) -> Result<DeclarativeProviderConfig> {
-    let id = generate_id(&display_name);
-    let api_key_name = generate_api_key_name(&id);
-
-    let config = Config::global();
-    config.set_secret(&api_key_name, &api_key)?;
+    let id = generate_id(&params.display_name);
+
+    let api_key_env = if params.requires_auth {
+        let api_key_name = generate_api_key_name(&id);
+        let config = Config::global();
+        config.set_secret(&api_key_name, &params.api_key)?;
+        api_key_name
+    } else {
+        String::new()
+    };
 
-    let model_infos: Vec<ModelInfo> = models
+    let model_infos: Vec<ModelInfo> = params
+        .models
         .into_iter()
         .map(|name| ModelInfo::new(name, 128000))
         .collect();
 
     let provider_config = DeclarativeProviderConfig {
         name: id.clone(),
-        engine: match engine {
+        engine: match params.engine.as_str() {
             "openai_compatible" => ProviderEngine::OpenAI,
             "anthropic_compatible" => ProviderEngine::Anthropic,
             "ollama_compatible" => ProviderEngine::Ollama,
-            _ => return Err(anyhow::anyhow!("Invalid provider type: {}", engine)),
+            _ => return Err(anyhow::anyhow!("Invalid provider type: {}", params.engine)),
         },
-        display_name: display_name.clone(),
-        description: Some(format!("Custom {} provider", display_name)),
-        api_key_env: api_key_name,
-        base_url: api_url,
+        display_name: params.display_name.clone(),
+        description: Some(format!("Custom {} provider", params.display_name)),
+        api_key_env,
+        base_url: params.api_url,
         models: model_infos,
-        headers,
+        headers: params.headers,
         timeout_seconds: None,
-        supports_streaming,
+        supports_streaming: params.supports_streaming,
+        requires_auth: params.requires_auth,
     };
 
     let custom_providers_dir = custom_providers_dir();
@@ -133,49 +166,54 @@ pub fn create_custom_provider(
     Ok(provider_config)
 }
 
-pub fn update_custom_provider(
-    id: &str,
-    provider_type: &str,
-    display_name: String,
-    api_url: String,
-    api_key: String,
-    models: Vec<String>,
-    supports_streaming: Option<bool>,
-) -> Result<()> {
-    let loaded_provider = load_provider(id)?;
+pub fn update_custom_provider(params: UpdateCustomProviderParams) -> Result<()> {
+    let loaded_provider = load_provider(&params.id)?;
     let existing_config = loaded_provider.config;
     let editable = loaded_provider.is_editable;
 
     let config = Config::global();
-    if !api_key.is_empty() {
-        config.set_secret(&existing_config.api_key_env, &api_key)?;
-    }
+
+    let api_key_env = if params.requires_auth {
+        let api_key_name = if existing_config.api_key_env.is_empty() {
+            generate_api_key_name(&params.id)
+        } else {
+            existing_config.api_key_env.clone()
+        };
+        if !params.api_key.is_empty() {
+            config.set_secret(&api_key_name, &params.api_key)?;
+        }
+        api_key_name
+    } else {
+        String::new()
+    };
 
     if editable {
-        let model_infos: Vec<ModelInfo> = models
+        let model_infos: Vec<ModelInfo> = params
+            .models
             .into_iter()
             .map(|name| ModelInfo::new(name, 128000))
             .collect();
 
         let updated_config = DeclarativeProviderConfig {
-            name: id.to_string(),
-            engine: match provider_type {
+            name: params.id.clone(),
+            engine: match params.engine.as_str() {
                 "openai_compatible" => ProviderEngine::OpenAI,
                 "anthropic_compatible" => ProviderEngine::Anthropic,
                 "ollama_compatible" => ProviderEngine::Ollama,
-                _ => return Err(anyhow::anyhow!("Invalid provider type: {}", provider_type)),
+                _ => return Err(anyhow::anyhow!("Invalid provider type: {}", params.engine)),
             },
-            display_name,
+            display_name: params.display_name,
             description: existing_config.description,
-            api_key_env: existing_config.api_key_env,
-            base_url: api_url,
+            api_key_env,
+            base_url: params.api_url,
             models: model_infos,
-            headers: existing_config.headers,
+            headers: params.headers.or(existing_config.headers),
             timeout_seconds: existing_config.timeout_seconds,
-            supports_streaming,
+            supports_streaming: params.supports_streaming,
+            requires_auth: params.requires_auth,
         };
 
-        let file_path = custom_providers_dir().join(format!("{}.json", id));
+        let file_path = custom_providers_dir().join(format!("{}.json", updated_config.name));
         let json_content = serde_json::to_string_pretty(&updated_config)?;
         std::fs::write(file_path, json_content)?;
     }

crates/goose/src/providers/api_client.rs

@@ -21,6 +21,7 @@ pub struct ApiClient {
 }
 
 pub enum AuthMethod {
+    NoAuth,
     BearerToken(String),
     ApiKey {
         header_name: String,
@@ -172,6 +173,7 @@ pub struct ApiResponse {
 impl fmt::Debug for AuthMethod {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
+            AuthMethod::NoAuth => f.debug_tuple("NoAuth").finish(),
             AuthMethod::BearerToken(_) => f.debug_tuple("BearerToken").field(&"[hidden]").finish(),
             AuthMethod::ApiKey { header_name, .. } => f
                 .debug_struct("ApiKey")
@@ -379,6 +381,7 @@ impl<'a> ApiRequestBuilder<'a> {
         request = request.header(SESSION_ID_HEADER, self.session_id);
 
         request = match &self.client.auth {
+            AuthMethod::NoAuth => request,
             AuthMethod::BearerToken(token) => {
                 request.header("Authorization", format!("Bearer {}", token))
             }

crates/goose/src/providers/factory.rs

@@ -316,13 +316,12 @@ mod tests {
     #[tokio::test]
     async fn test_openai_compatible_providers_config_keys() {
         let providers_list = providers().await;
-        let cases = vec![
-            ("openai", "OPENAI_API_KEY"),
+        let required_api_key_cases = vec![
             ("groq", "GROQ_API_KEY"),
             ("mistral", "MISTRAL_API_KEY"),
             ("custom_deepseek", "DEEPSEEK_API_KEY"),
         ];
-        for (name, expected_key) in cases {
+        for (name, expected_key) in required_api_key_cases {
             if let Some((meta, _)) = providers_list.iter().find(|(m, _)| m.name == name) {
                 assert!(
                     !meta.config_keys.is_empty(),
@@ -346,5 +345,24 @@ mod tests {
                 continue;
             }
         }
+
+        if let Some((meta, _)) = providers_list.iter().find(|(m, _)| m.name == "openai") {
+            assert!(
+                !meta.config_keys.is_empty(),
+                "openai provider should have config keys"
+            );
+            assert_eq!(
+                meta.config_keys[0].name, "OPENAI_API_KEY",
+                "First config key for openai should be OPENAI_API_KEY"
+            );
+            assert!(
+                !meta.config_keys[0].required,
+                "OPENAI_API_KEY should be optional for local server support"
+            );
+            assert!(
+                meta.config_keys[0].secret,
+                "OPENAI_API_KEY should be secret"
+            );
+        }
     }
 }