improvement(agent-proxy): optional basic auth password + docs link on proxied service sheet

[saifsmailbox98]

Context

Feedback from trying out the agent proxy: Basic Auth on a proxied service was forcing both a username and a password, but plenty of APIs authenticate with just a username and an empty password (Ashby, and the common "API key as username" pattern), producing Authorization: Basic base64(username:). Agent Vault already allows this, so this closes a parity gap. Also adds a documentation link to the create/edit proxied service sheet, which previously had no pointer to the docs anywhere.

Backend: credential validation required the username and password counts to match (Basic auth requires both a username and a password credential). Now the password is optional and only a lone password with no username is rejected. The "at most one of each" and "can't combine basic auth with other header rewrites" rules are unchanged.

Frontend: the Password field on the Basic Auth tab is marked (optional) and is no longer required by the form schema (passwordSecretKey is now optional on the object schema, not just skipped in the refine, so a username-only create doesn't silently fail Zod validation). Added a Documentation badge next to the title on both the create and edit sheets, linking to the agent proxy quickstart.

Docs: the basic auth row on the proxied services page notes the password is optional and that omitting it yields base64(username:).

CLI: no code change needed. The proxy already emits base64(username:) when the password credential is absent; added a test there to lock it in. Companion PR: Infisical/cli#316

Screenshots

Steps to verify the change

Created a proxied service with only a Username credential (no password) pointing at a local echo server, connected an agent through the proxy, and confirmed the injected header was Authorization: Basic base64("<secret>:") (empty password segment). Before this change the create call was rejected with "Basic auth requires both a username and a password credential".

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
• Tested locally
• Updated docs (if needed)
• Updated CLAUDE.md files (if needed)
• Read the contributing guide

[infisical-review-police]

💬 Discussion in Slack: #pr-review-infisical-7296-improvement-agent-proxy-optional-basic-auth-password-do

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[linear]

AGE2-39

[greptile-apps]

Greptile Summary

This PR closes a parity gap between Agent Vault and the agent proxy by making the Basic Auth password credential optional. The backend validation condition is tightened from a symmetric username/password count check to a one-directional guard (password-without-username is rejected; username-without-password is now allowed). The frontend schema, form UI, and docs are updated consistently.

• Backend (proxied-service-schemas.ts): replaces usernameCount !== passwordCount with passwordCount > 0 && usernameCount === 0; four new unit tests cover the changed condition.
• Frontend (schema.ts, ProxiedServiceForm.tsx): passwordSecretKey is now .optional() in Zod; the redundant superRefine password check is removed; the Password field shows "(optional)". The toCredentials truthy-guard already handled the empty-password case and remains correct.
• UI (CreateProxiedServiceModal.tsx, EditProxiedServiceModal.tsx): a DocumentationLinkBadge linking to the agent-proxy quickstart is added to both sheets, with the QUICKSTART_DOCS_URL constant duplicated rather than shared.

Confidence Score: 4/5

Safe to merge; all changed paths behave correctly and the new flexibility is well-tested.

The backend and frontend changes are narrow, self-consistent, and covered by tests. The only issue found is the QUICKSTART_DOCS_URL constant being duplicated across the two modal files instead of shared, which has no runtime impact.

CreateProxiedServiceModal.tsx and EditProxiedServiceModal.tsx share an identical URL constant that could be extracted to avoid future drift.

Important Files Changed

Filename	Overview
backend/src/ee/services/proxied-service/proxied-service-schemas.ts	Relaxes basic-auth credential validation: replaces the symmetric username/password count check with a one-directional guard (password without username is rejected; username without password is now allowed). Logic is correct and narrowly scoped.
backend/src/ee/services/proxied-service/proxied-service-schemas.test.ts	Adds four focused tests for the relaxed basic-auth validation: username-only (accept), username+password (accept), password-only (reject with "requires a username"), and two usernames (reject with "at most one"). Good coverage of the changed condition.
frontend/src/components/proxied-services/forms/schema.ts	Makes passwordSecretKey optional in basicAuthSchema and removes the superRefine check that previously rejected a missing password. The empty-string fallback in toServiceDefaults and the truthy-guard in toCredentials both handle the "" / undefined edge case correctly.
frontend/src/components/proxied-services/forms/ProxiedServiceForm.tsx	Adds "(optional)" label to the Password field using text-muted Tailwind class. The toCredentials truthy-check already handled the empty-password case and remains correct.
frontend/src/components/proxied-services/CreateProxiedServiceModal.tsx	Adds a DocumentationLinkBadge linking to the agent-proxy quickstart. QUICKSTART_DOCS_URL is duplicated here and in EditProxiedServiceModal.tsx rather than shared.
frontend/src/components/proxied-services/EditProxiedServiceModal.tsx	Same DocumentationLinkBadge addition as Create modal. Shares the same duplicated QUICKSTART_DOCS_URL constant.
docs/documentation/platform/agent-proxy/proxied-services.mdx	Updates the basic-auth table row and adds a clarifying sentence that the password is optional and that omitting it yields base64(username:). Accurate and consistent with the code change.

_{Reviews (1): Last reviewed commit: "improvement(agent-proxy): optional basic..." | Re-trigger Greptile}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
infisical	🟢 Ready	View Preview	Jul 15, 2026, 9:12 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
infisical	🟡 Building	–	Jul 15, 2026, 9:08 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.