OpenRouterProvider.generate_video downloads without auth header — 100% failure rate

[santoshkumarradha]

Summary

OpenRouterProvider.generate_video in sdk/python/agentfield/media_providers.py (~lines 1018-1041 in the released 0.1.84 build) downloads the final video bytes from unsigned_urls[0] without passing the Authorization header. The comment in the source claims "video_url is a public CDN URL" — that comment is wrong.

OpenRouter's unsigned_urls are of the form:

https://openrouter.ai/api/v1/videos/<job_id>/content?index=0

That is an API endpoint, not a CDN. It requires the Bearer token. As a result, every call to generate_video 401s on the download step and the SDK raises before returning the video bytes. End result: 100% video-generation failure rate when using generate_video with any model that lands on the /videos async lifecycle (e.g. google/veo-2.0-generate-001, google/veo-3.1-lite).

The completed-job response only ever contains unsigned_urls, never signed_urls:

{
  "id": "IVF9g3DZu84cpX6rAWXX",
  "status": "completed",
  "unsigned_urls": ["https://openrouter.ai/api/v1/videos/IVF.../content?index=0"],
  "usage": {"cost": 0.2, "is_byok": false}
}

Repro

from agentfield.media_providers import OpenRouterProvider
await OpenRouterProvider().generate_video(
    prompt="A cat playing piano",
    model="openrouter/google/veo-2.0-generate-001",
    duration=4,
)
# RuntimeError: Failed to download video from https://openrouter.ai/api/v1/videos/.../content?index=0: HTTP 401

Suggested fix

Pass headers=headers to the download session.get. The same headers dict is already constructed for the submit and poll calls a few lines above. If hosts other than openrouter.ai should not receive the Bearer token, gate the headers by URL hostname:

from urllib.parse import urlparse
download_headers = headers if (urlparse(video_url).hostname or "").endswith("openrouter.ai") else {}
async with session.get(video_url, headers=download_headers) as resp:
    ...

Status

This is fixed on origin/main (see download_headers gated by hostname around line 1127 of media_providers.py). The bug is still present in the latest released version agentfield==0.1.84, which is what surfaced this. Filing for visibility once an 0.1.85 release cuts so consumers can drop their workarounds.

Consumer workaround

reel-af ships a runtime monkey-patch (src/reel_af/sdk_patches.py::_patch_openrouter_video_download) that re-defines OpenRouterProvider.generate_video with the auth header included on the download. Same SDK call path otherwise.

Found by the Python SDK consumer reel-af (an AgentField example pipeline).

[santoshkumarradha]

Code on origin/main already addresses this — see PR #579. Filing for tracking so a release cuts and consumers (agentfield==0.1.84 users like reel-af) can drop their workarounds. Once 0.1.85 is on PyPI this can likely be closed.