The opt-in key-auth Responses hosted-search bridge follows the continuation binding contract.
POST /v1/alpha/search relays verbatim through a configured ChatGPT forward provider. When no
forward candidate exists, an explicitly configured webSearchSidecar.backend of anthropic,
xai, gemini, or exa serves the request instead, spending only that backend's own
credential: src/web-search/alpha-search.ts runs the query through that backend's executor and
answers { encrypted_output: null, output, results }. An unset or openai backend and a sidecar
disabled by enabled: false keep the ChatGPT-auth 400. A named backend whose credential is
missing is refused as well, but the message names that backend and the credential it could not
find instead of asking for ChatGPT auth, and the request reaches no other backend. A backend that
fails answers with its own diagnostic. The fallback never runs while a forward candidate exists,
so the verbatim relay stays the path for a ChatGPT deployment.
A configured key's scope covers both branches, each against what it actually reaches. An
account-qualified selector is judged against its resolved route; an unqualified one against the
account the upstream resolved and the model the body names; the fallback against the configured
backend and the model that backend runs, with Exa named by its backend because it has no provider
entry. tests/server/api-key-scope-alpha-search.test.ts covers the two unrouted branches.
POST /v1/alpha/search retains the selected model in its request body. When that value is an
account-qualified native selector, the server resolves the public namespace, uses only the mapped
stored Codex credential, and sends the bare native model upstream. That exact path is fail-closed:
it does not consult Pool active state or affinity when selecting, and its outcomes cannot rotate
the active Pool account. An account-wide credential failure still quarantines that credential and
clears stale ordinary Pool affinities so they cannot reappear after reauthentication. Quota and
transient outcomes from an exact request leave Pool affinities untouched. Ordinary search requests
keep the normal Direct/Pool sidecar behavior.
Standalone Images and Live requests currently carry neither the account-qualified model selector nor a trustworthy thread correlation from the Codex client. They therefore retain normal provider routing. Do not infer an exact account from caller-supplied account headers, process-global last selection, connection identity, or other ambient state; concurrent threads could cross-route credentials. Extending exact routing to those endpoints requires an opaque client correlation that can be bound server-side to a previously validated selector.