AISIX 0.8.1

Release date: August 7, 2026

This is a maintenance release. It corrects how the gateway decides that an upstream speaks the Anthropic protocol, so a model pointed at a self-managed Anthropic endpoint is served on the whole /v1/messages family with its request body passed through unchanged. It also gives authentication denials enough context to investigate, carries tool grants through an MCP server rename, and fixes several control-plane admission paths that had no workable request shape or no actionable error.

Behavior Changes

Enabling auto_prompt_caching now requires a model whose provider key speaks the Anthropic protocol, either provider: anthropic or a BYO key whose adapter is Anthropic. The setting is implemented by injecting Anthropic cache_control markers, so on any other upstream it was stored but never took effect, and nothing told the operator that their prompt caching was off. Enabling it elsewhere now returns 400. Disabling remains valid on every provider, so a model configured before this release can still be cleaned up, and a key whose adapter cannot be determined is allowed rather than rejected on a guess. See Prompt Caching.
A model configured as provider: byo with the Anthropic adapter is now served on /v1/messages by passing its request body through unchanged, instead of re-encoding it through the cross-provider bridge. A cache_control marker set by the client reaches the upstream as written; it was previously dropped, or rewritten to the model's configured TTL when auto_prompt_caching was enabled. This also changes which upstream cache-write price applies, since a one-hour write costs twice the base input price and a five-minute write costs 1.25 times. Authentication is unchanged.

Improvements

Authentication denials now carry the request context needed to act on them: the caller address resolved through the trusted-proxy configuration, the HTTP method and path, and the request id. Denials for a disabled or expired key also carry the key id. A 401 is refused before any handler runs and therefore never reaches the access log, which left the denial counter as the only record and it cannot say who, when, or against which route. Log levels are unchanged, so scanner traffic stays at debug and the default-level output is exactly as before. See Metrics and Logs.
The AISIX Cloud Admin API reference now describes provider request headers and conditional rate-limit counter semantics correctly. It previously said that changing a policy's conditions resets the current windows; counter keys are built from the policy id and the selected group_by values, so changing only conditions or limits preserves existing keys and their counts, while changing the grouping dimensions moves requests to different keys.

Fixes

/v1/messages/count_tokens now serves a model whose provider key speaks Anthropic through an adapter rather than by vendor id. A provider: byo model pointed at an Anthropic-protocol endpoint was rejected with 400 on this endpoint while the sibling /v1/messages served it normally.
Renaming an MCP server now carries the tool grants with it. Tool names are <server>__<tool>, so every grant references the server by name; the per-key rate limit entries already followed a rename but the access control did not, which silently revoked access to the whole server and made its tools disappear from tools/list with no explanation. The caller key's allowed_tools and mcp_access, and the environment- and team-level access policies, are all rewritten. Wildcards that match a shape rather than one server, such as a bare *, are left alone. See MCP Access Control.
Provider keys for Amazon Bedrock and Google Vertex can now be created by supplying config alone. Their credentials do not fit in a single api_key string, but api_key was required by the schema and a non-empty value was rejected by the handler, so the only accepted request was an empty string that no documentation mentioned. A request missing its credential now names the field that provider actually accepts. See Provider Keys.
PATCH with "tls": null now clears a provider key's TLS settings, matching how rate_limit and the other optional blocks behave. It previously returned 400 and the setting could only be cleared with an empty object.
The usage feed and its CSV export now include audio_duration_seconds. A transcription priced by duration showed a cost whose basis could not be read back from the API. The field is omitted for requests that carry no audio. See Audio.
The offline package no longer lets two installations become one. The Compose project name came from the directory the package was unpacked into, so unpacking a second copy elsewhere and running run.sh took over the running installation, rebuilding its containers against the second copy's configuration while keeping the original data volume. The project name is now fixed to the package, and starting it while another directory holds the same stack is refused with both paths and the ways forward. Upgrading in place is unaffected, and a second independent installation can still be started with an explicit COMPOSE_PROJECT_NAME. See On-Premises Quickstart.
The Dashboard container in the offline package now has a writable Next.js cache directory, matching the Helm chart.
Trusted-proxy CIDRs and the User-Agent client-type rules can now be set from the environment. proxy.real_ip.trusted_proxies and observability.metrics.client_type_rules could only be supplied in a configuration file; setting either through its AISIX_* variable failed to start the gateway. Deployments configured purely through environment variables — the Helm chart and the Dashboard's docker run snippet — therefore could not declare their load balancer as a trusted proxy, so every request appeared to come from it. See Metrics and Logs.
Two admission errors now say what to change. A weight on a target in a group that is not weighted names the field and the strategy instead of reporting a generic invalid-fields error, and an unrecognized provider names the rejected value and explains that the catalog route needs a Dashboard session rather than an admin token.
The Dashboard now lets one API key allow several model groups. Checking one group greyed out the rest, so a key could only ever reference one, although the API always accepted a longer list and the edit dialog never enforced the limit. The two dialogs now share one picker, which also fixes model groups, ensembles, embedding models, and semantic routers rendering with an empty arrow in the edit dialog.