fix(runtime): don't generate an API key name for custom_jwt deploys

`_prepare_runtime_config` generated (and logged "Generated API key name:")
an API key whenever `runtime_apikey_name` was "Auto", regardless of auth
type. For `custom_jwt`, the gateway authorizes via JWT and never uses an
API key (`_build_authorizer_config_for_create` only reads the name in the
key_auth branch), so the generated key was unused and the log line was
misleading. Skip generation/logging when auth type is custom_jwt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: yaozheng-fang

agentkit/toolkit/runners/ve_agentkit.py

@@ -585,8 +585,11 @@ def _prepare_runtime_config(self, config: VeAgentkitRunnerConfig) -> bool:
                     f"Generated role name: {config.runtime_role_name}"
                 )
 
-            # Generate API key name if not provided
-            if (
+            # Generate API key name if not provided. Skipped for custom_jwt: the
+            # gateway authorizes via JWT and never uses an API key (see
+            # _build_authorizer_config_for_create), so generating one here only
+            # produced a misleading "Generated API key name" line.
+            if config.runtime_auth_type != AUTH_TYPE_CUSTOM_JWT and (
                 config.runtime_apikey_name == AUTO_CREATE_VE
                 or not config.runtime_apikey_name
             ):

tests/toolkit/runners/test_ve_agentkit_apikey_auth.py

@@ -0,0 +1,53 @@
+# Copyright (c) 2026 Beijing Volcano Engine Technology Co., Ltd. and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""`_prepare_runtime_config` API-key-name generation is gated on auth type."""
+
+from agentkit.toolkit.config.constants import (
+    AUTH_TYPE_CUSTOM_JWT,
+    AUTH_TYPE_KEY_AUTH,
+    AUTO_CREATE_VE,
+)
+from agentkit.toolkit.runners.ve_agentkit import (
+    VeAgentkitRunnerConfig,
+    VeAgentkitRuntimeRunner,
+)
+
+
+def _config(auth_type: str) -> VeAgentkitRunnerConfig:
+    # Pin name/role so only the API-key-name branch is exercised.
+    return VeAgentkitRunnerConfig(
+        runtime_name="rt",
+        runtime_role_name="role",
+        runtime_apikey_name=AUTO_CREATE_VE,
+        runtime_auth_type=auth_type,
+    )
+
+
+def test_custom_jwt_does_not_generate_api_key_name():
+    runner = VeAgentkitRuntimeRunner()
+    cfg = _config(AUTH_TYPE_CUSTOM_JWT)
+
+    assert runner._prepare_runtime_config(cfg) is True
+    # custom_jwt authorizes via JWT, so no API key name is generated.
+    assert cfg.runtime_apikey_name == AUTO_CREATE_VE
+
+
+def test_key_auth_still_generates_api_key_name():
+    runner = VeAgentkitRuntimeRunner()
+    cfg = _config(AUTH_TYPE_KEY_AUTH)
+
+    assert runner._prepare_runtime_config(cfg) is True
+    # key_auth uses the API key name, so it is generated (no longer "Auto").
+    assert cfg.runtime_apikey_name not in (AUTO_CREATE_VE, "")