[Feat] Enter the voice API key from Settings > Integrations - #2487
Merged
Conversation
…ttings Voice previously required the R_VOICE_OPENAI_API_KEY environment variable. Deployments can now enter the OpenAI key from Settings > Integrations > Voice, following the ElevenLabs credential-only pattern: the key is encrypted in the deployment-wide connection row, never delivered to agents, and consumed only by the control plane. The environment variable still takes precedence when set; the stored key is the fallback. - New `voice` credential_only integration entry, config type and guard - get/save commands, router procedures, and hooks - Voice card and dialog in Settings > Integrations, with a waveform icon - Key resolution falls back to the stored connection after the env var - Docs: integration page, nav, overview row, and the voice guide
Contributor
![roomote-community[bot]](https://avatars.githubusercontent.com/u/211522643?s=60&v=4){kind=small}
Only an environment-provided key is cached. The stored connection is read on every call, so saving, rotating, or disconnecting the Voice integration takes effect immediately instead of after the 30-second cache window.
The voice connection query reports where the key comes from. With R_VOICE_OPENAI_API_KEY set, the card sits under Connected with a note and no configure or disconnect action, since there is nothing to manage in Settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
R_VOICE_OPENAI_API_KEYfirst and falls back to the stored connection, so voice works on deployments that cannot set environment variables, while operators who set the variable keep control. Only the environment-provided key is cached; the stored key is read on every call so saves, rotations, and disconnects apply immediately.voiceintegration entry, config type and guard, get/save commands and router procedures, hooks, the card and dialog in Settings, a waveform icon, and setup-catalog capabilities.Why this change was made
Voice shipped requiring
R_VOICE_OPENAI_API_KEY. Managed deployments and admins without environment access had no way to turn it on. Integrations is where deployment-wide credentials already live, and ElevenLabs established the credential-only shape.Impact
Admins can enable voice from the UI. Nothing changes for deployments that already set the environment variable. The general
OPENAI_API_KEYis still never used for voice.Verification
Types, cloud-agents, and web typecheck; oxlint, residual ESLint, and knip clean. Tests: types integration catalog and guard, web Integrations page (new admin dialog case), voice server and command suites, mcp-connections commands, and the sdk delivery test confirming credential-only connections never reach agents. Verified in a local deployment that the Voice card renders in Settings > Integrations, the Connect dialog opens with the key field, and with
R_VOICE_OPENAI_API_KEYset the card appears under Connected with the environment note.