[neilberkman]

Google requests sent API credentials in URL query parameters, exposing them to URL-based proxy/access logs and request telemetry. Only streaming requests supported optional header authentication; non-streaming requests and cached-content operations always used query authentication.

Use x-goog-api-key by default for generation, streaming, single/batch embeddings, image generation, and all Google AI Studio cached-content operations. Keep query authentication available through google_auth_header: false. Update the provider documentation and guide.

Non-streaming fixture replay compares the method, URL, and request body, while streaming replay selects the named fixture. Ignore only Google's authentication query parameter when comparing URLs; headers are already excluded from comparison. Preserve all other request comparisons. Add Google header redaction to streaming metadata, fixture capture, and billing test artifacts. No recorded fixtures were changed or re-recorded.

Verification:

• mix format: passed.
• mix compile --warnings-as-errors: passed.
• mix credo --strict: passed; no issues across 626 source files.
• Focused provider, authentication, cached-content, fixture, streaming-metadata, and transcript tests: 203 passed, 3 skipped.
• mix test: 5,366 passed, 11 skipped, 240 excluded.
• mix test --only provider:google: failed; 43 passed, 11 failed, 4 skipped, 5,559 excluded. Four failures are missing fixtures (embedding basic/batch and context append), five are existing maxOutputTokens mismatches, one is responseSchema.propertyOrdering, and one is candidateCount. The same 11 failures reproduce in the four affected coverage modules after loading the original Google provider and fixture matcher from the branch baseline in memory (5 passed, 11 failed). The default full suite excludes coverage tests. No authentication URL mismatches remain.

The initial mix compile failed because copied dependencies differed from mix.lock; mix deps.get fetched the locked versions without changing the lockfile, and compilation then passed. No live requests were run.

Compatibility decision: proxies that only accept query authentication now require an explicit opt-out. For provider calls use provider_options: [google_auth_header: false]; for Google.CachedContent calls pass google_auth_header: false directly. Maintainers should decide how to coordinate this default change and the existing coverage-fixture failures for release.

🤖 Generated with Codex and Claude Code