Reject empty OpenAI API keys

[Button99]

What:

• Bug Fix
• New Feature
• Docs

Description:

This PR treats empty and whitespace-only OpenAI API keys as missing configuration.

Previously, config('openai.api_key') only had to be a string. That allowed values like '' or ' ' to pass validation and build a client, causing the failure to happen later as an API authentication error instead of the package's ApiKeyIsMissing exception.

Related:

N/A

[iBotPeaches]

I'm fairly sure this will break OIDC for those using AWS Bedrock roles vs keys. I'll have to test when I have a chance. Since we keep the API key blank and it assumes the role for some ephemeral OIDC token.

Though looking at code it was probably accidental that it worked that way in the first place. Good find regardless, but don't want to risk this enforcement until I understand the different ways we can auth outside of a basic api key.

So holding for a bit.

[Button99]

That makes sense. I did not consider OpenAI-compatible/custom base URI setups where auth may happen outside of a static API key.

Would you prefer this validation to only reject empty API keys when using the default OpenAI base URI, while allowing empty keys for custom openai.base_uri configurations?