# BullSequana AI 1.2.1 (/docs/release-notes/1-2-1) [← All release notes](/docs/release-notes) **Released:** August 6, 2026 ## Executive summary [#executive-summary] This is a patch release on top of 1.2.0. API keys now work as standard `Authorization: Bearer` tokens through the platform gateway, so OpenAI-compatible tools and SDKs connect without workarounds, and the updated BSQAI API backend delivers the Anthropic Messages API and streaming model downloads. LiteLLM gains a 600-second request budget for long generations, Redis-backed response and authentication caching, and high-availability hardening. Kubeflow default pipelines and MLflow notebook credentials are fixed for all profile namespaces. The BSQAI API backend is updated to 1.2.9 and the portal to 1.2.3. *** ## Fixes & improvements [#fixes--improvements] * **API keys as Bearer tokens through the gateway**: requests carrying a BSQAI API key as `Authorization: Bearer sk-bsq-...` are now routed past gateway-level JWT validation and authenticated by the BSQAI API itself. Previously the gateway rejected these requests with `Jwt is not in the form of Header.Payload.Signature` before they reached the backend, which is why 1.2.0 recommended the `X-Api-Key` header for clients behind the gateway. That workaround is no longer required: OpenAI-compatible SDKs and tools that hardcode the `Authorization: Bearer` header now work natively. `X-Api-Key` remains fully supported. Invalid or malformed keys are still rejected by the backend, and JWT validation at the gateway is unchanged for all other bearer tokens. See [Use local models via API](/docs/develop/use-local-models-via-api). * **API keys accepted in the interactive API docs**: the Swagger (`/docs`) and Scalar (`/scalar`) UIs now authenticate correctly with BSQAI API keys, and the `X-Api-Key` security scheme resolves on WebSocket routes in the generated API documentation. * **Anthropic Messages API compatibility**: the BSQAI API now serves an Anthropic-compatible endpoint at `/anthropic`. Tools that speak the Anthropic wire format, such as Claude Code and the Anthropic SDK, can use platform-hosted models with platform authentication. No Anthropic account is required. The endpoint supports streaming and non-streaming turns, model and agent configuration resolution, token counting, and a per-user model catalogue. See [Claude Code](/docs/develop/developer-tools/claude-code). * **Streaming model downloads**: model installer downloads from Hugging Face and S3-compatible storage now stream directly to the destination instead of buffering the full artifact in memory. This reduces memory pressure and improves reliability for large model imports. * **LiteLLM reliability and performance**: LiteLLM is upgraded to 1.89.4 (mirrored in the private registry) with several operational fixes: * Gateway route and proxy request timeouts are raised to 600 seconds, so long generations and streaming responses are no longer cut off mid-request by the previous short gateway timeout. * A Redis instance now backs a response cache and a shared authentication cache, keeping virtual-key state consistent across workers and replicas. * Worker count is pinned per pod instead of derived from node cores, preventing CPU oversubscription on large nodes. * Replicas spread across nodes, health probes are defined for startup, liveness, and readiness, and failed upstream calls retry up to three times. * **Kubeflow default pipeline and MLflow notebook credentials**: expanded Kyverno policies now generate the MLflow notebook credentials (secret and PodDefault), registry pull-secret PodDefault, pipeline S3 credentials, per-profile MLflow provisioning job, and scoped RBAC in every profile namespace, including both existing namespaces and newly created profiles. This fixes the default Kubeflow pipeline failing to run and notebooks failing with a missing MLflow secret. * **Reranker model mode**: reranker models are now recognized as a dedicated `rerank` model mode across the backend model catalogue and the portal, fixing reranker model selection in Global Configuration. * **Self-contained backend image builds**: the backend container image now builds without internet access and multi-architecture image builds are fixed, supporting offline and air-gapped delivery pipelines. * **Security patches**: the backend 1.2.9 image patches CVE-2026-69244, CVE-2026-69247, CVE-2026-69249, and GHSA-3f7w-8rr8-f37f; the portal 1.2.3 image patches Next.js and PostCSS dependency vulnerabilities. * **BSQAI API backend 1.2.9**: the release moves the backend from 1.2.5 to 1.2.9, which carries the API-key authentication paths, the Anthropic Messages API, streaming model downloads, the reranker model mode, and the build and security fixes above. * **CoreAI Web Portal 1.2.3**: carries the reranker model mode fix and the dependency security patches above. * **Speech-to-text GPU model corrected**: the default GPU Whisper model is now `deepdml/faster-whisper-large-v3-turbo-ct2`, a CTranslate2 build compatible with FasterWhisper. The previous default referenced a model artifact the GPU speech server could not load. * **Platform CLI: optional temp-file retention**: setting `CLEANUP_TEMPORARY_FILES=false` keeps the rendered Helm values files and the cloned GitOps repository directory after a run for debugging. Cleanup remains the default. See [Platform CLI](/docs/deployment/platform-cli). *** ## Platform deployment changes [#platform-deployment-changes] * **New `litellm-redis` StatefulSet**: the litellm namespace gains a Redis StatefulSet with a persistent volume and a generated connection secret. Argo CD is configured to ignore server-side-apply drift on its `volumeClaimTemplates`. * **New API-key HTTPRoute**: the BSQAI API gateway configuration adds a dedicated `HTTPRoute` matching `Authorization: Bearer sk-bsq-*` requests, covered by a CORS-only security policy instead of the JWT policy. * No manual migration steps are required. Deployments pick up the changes through the standard render and GitOps sync flow. *** ## API updates [#api-updates] No breaking changes in this release. ### Authentication: API keys in the `Authorization: Bearer` header [#authentication-api-keys-in-the-authorization-bearer-header] API keys are now accepted through the gateway in both header styles: ``` Authorization: Bearer sk-bsq-v1- X-Api-Key: sk-bsq-v1- ``` In 1.2.0, only `X-Api-Key` worked for clients calling through the platform gateway. As of 1.2.1 both forms are equivalent end to end; when both headers are present, `X-Api-Key` still takes precedence. WebSocket connections continue to use the `token` query parameter. ### Anthropic Messages API [#anthropic-messages-api] A new Anthropic-compatible API surface is available at `/anthropic`. | Route | Purpose | | ------------------------------------------ | ------------------------------------------------------------- | | `POST /anthropic/v1/messages` | Single turn, streaming or non-streaming | | `POST /anthropic/v1/messages/count_tokens` | Input token estimate without calling a model | | `GET /anthropic/v1/models` | List available models and agent configurations for the caller | Authentication uses the same `X-Api-Key` or `Authorization: Bearer` headers as the main API. Model ids must use the `claude-model-` or `claude-agent-` prefix for Claude Code compatibility. Direct SDK and curl callers may also use bare model names. The models endpoint is scoped per user: agent configurations the caller cannot access are not listed, and requesting one returns 404 rather than 403. See [Claude Code](/docs/develop/developer-tools/claude-code) for configuration and usage. *** ## Documentation updates [#documentation-updates] | Page | What was updated | | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- | | [Use local models via API](/docs/develop/use-local-models-via-api) | Version callout: the `Authorization: Bearer` form for API keys requires platform 1.2.1 or later | | [OpenCode](/docs/develop/developer-tools/opencode) | Version callout: the documented integration requires platform 1.2.1 or later | | [Troubleshooting](/docs/troubleshooting) | Gateway API routing checks (`httproute`), pre-1.2.1 API-key auth symptom, updated component links | | [Platform CLI](/docs/deployment/platform-cli) | New Debugging section documenting `CLEANUP_TEMPORARY_FILES` | | [LiteLLM](/docs/ai/components/litellm) | New Deployment notes section: request timeouts, Redis-backed caching, worker and replica behavior | | [Claude Code](/docs/develop/developer-tools/claude-code) | New page: configure Claude Code with the Anthropic-compatible endpoint | | [BSQAI API](/docs/ai/components/bsqai-api) | Added Anthropic Messages API section | | [API Reference](/docs/reference) | Added Anthropic Messages API endpoint | | [Developer Tools](/docs/develop/developer-tools) | Added Claude Code to available guides |