redirect to api key page when access gateway in browser

server/routers/badger/verifySession.ts

@@ -337,10 +337,16 @@ export async function verifyResourceSession(
         // Only offer a browser redirect to clients that can actually follow one and log in
         // (an interactive browser). Non-browser clients (curl, scripts, bots, etc.) just get
         // an unauthorized response from Badger instead of a login redirect URL.
+        // Inference browsers go to the dashboard keys page (not back to the inference host)
+        // so a valid session cannot create a redirect loop.
         const redirectPath = clientIsBrowser
-            ? `/auth/resource/${encodeURIComponent(
-                  resource.resourceGuid
-              )}?redirect=${encodeURIComponent(originalRequestURL)}`
+            ? mode === "inference"
+                ? `/${resource.orgId}/resource/${encodeURIComponent(
+                      resource.resourceGuid
+                  )}/keys`
+                : `/auth/resource/${encodeURIComponent(
+                      resource.resourceGuid
+                  )}?redirect=${encodeURIComponent(originalRequestURL)}`
             : undefined;
 
         // Virtual API keys for public inference resources (provider-style auth headers).

server/routers/resource/getResourceAuthInfo.ts

@@ -42,6 +42,7 @@ export type GetResourceAuthInfoResponse = {
     skipToIdpId: number | null;
     orgId: string;
     postAuthPath: string | null;
+    mode: string;
 };
 
 export async function getResourceAuthInfo(
@@ -227,7 +228,8 @@ export async function getResourceAuthInfo(
                 whitelist: effectivePolicy?.emailWhitelistEnabled ?? false,
                 skipToIdpId: effectivePolicy?.idpId ?? resource.skipToIdpId,
                 orgId: resource.orgId,
-                postAuthPath: resource.postAuthPath ?? null
+                postAuthPath: resource.postAuthPath ?? null,
+                mode: resource.mode
             },
             success: true,
             error: false,