redirect to api key page when access gateway in browser

src/app/[orgId]/resource/[resourceGuid]/keys/page.tsx

@@ -41,7 +41,9 @@ export default async function ResourceKeysPage(props: ResourceKeysPageProps) {
     const user = await getUser();
 
     if (!user) {
-        redirect("/");
+        redirect(
+            `/auth/login?redirect=/${orgId}/resource/${resourceGuid}/keys`
+        );
     }
 
     const cookieHeader = await authCookieHeader();

src/app/auth/resource/[resourceGuid]/page.tsx

@@ -71,6 +71,9 @@ export default async function ResourceAuthPage(props: {
         );
     }
 
+    const isInference = authInfo.mode === "inference";
+    const keysPath = `/${authInfo.orgId}/resource/${authInfo.resourceGuid}/keys`;
+
     const hasLoginPageDomain = await isOrgSubscribed(
         authInfo.orgId,
         tierMatrix.loginPageDomain
@@ -159,10 +162,18 @@ export default async function ResourceAuthPage(props: {
 
     if (user && !user.emailVerified && env.flags.emailVerificationRequired) {
         redirect(
-            `/auth/verify-email?redirect=/auth/resource/${authInfo.resourceGuid}`
+            `/auth/verify-email?redirect=${encodeURIComponent(
+                isInference
+                    ? keysPath
+                    : `/auth/resource/${authInfo.resourceGuid}`
+            )}`
         );
     }
 
+    if (isInference && !user) {
+        redirect(`/auth/login?redirect=${encodeURIComponent(keysPath)}`);
+    }
+
     const cookie = await authCookieHeader();
 
     // Check org policy compliance before proceeding
@@ -181,7 +192,9 @@ export default async function ResourceAuthPage(props: {
 
     // If user is not compliant with org policies, show policy requirements
     if (orgPolicyCheck && !orgPolicyCheck.allowed && orgPolicyCheck.policies) {
-        const resourceAuthPageUrl = `/auth/resource/${authInfo.resourceGuid}${redirectUrl !== authInfo.url ? `?redirect=${encodeURIComponent(redirectUrl)}` : ""}`;
+        const resourceAuthPageUrl = isInference
+            ? keysPath
+            : `/auth/resource/${authInfo.resourceGuid}${redirectUrl !== authInfo.url ? `?redirect=${encodeURIComponent(redirectUrl)}` : ""}`;
         return (
             <div className="w-full max-w-md">
                 <OrgPolicyRequired
@@ -193,6 +206,12 @@ export default async function ResourceAuthPage(props: {
         );
     }
 
+    // Inference resources never establish a resource session on the inference
+    // host. Authenticated users retrieve their virtual API key on the dashboard.
+    if (isInference) {
+        redirect(keysPath);
+    }
+
     if (!hasAuth) {
         // no authentication so always go straight to the resource
         redirect(redirectUrl);