Repository navigation
[awf] api-proxy: malformed Authorization header with COPILOT_PROVIDER_API_KEY (BYOK, v0.71.4) #2703
Closed as not planned
Description
Problem
When using BYOK with COPILOT_PROVIDER_API_KEY and an external provider base URL (e.g., OpenRouter), every request via the api-proxy fails with 400: Authorization header is badly formatted. All retries fail, causing the entire agent run to abort.
Context
Upstream: github/gh-aw#30169
- gh-aw v0.71.4, ubuntu-24.04
- `COPILOT_PROVIDER_BASE_URL: (openrouter.ai/redacted)
- Model:
minimax/minimax-m2.5:free
Root Cause
The api-proxy in containers/api-proxy/ likely double-encodes or mis-formats the Authorization header when injecting COPILOT_PROVIDER_API_KEY — possibly prepending Bearer to a value that already contains it, or incorrectly concatenating with another header.
Proposed Solution
- Audit the Authorization header construction in
containers/api-proxy/— ensure the injected key is formatted asBearer (raw_key)with no duplication. - Add a unit test for header injection with a raw API key value.
- Add an integration test against a mock external provider endpoint to verify header format.
Generated by Firewall Issue Dispatcher · ● 1.2M · ◷
Activity
github-actions commentedon May 7, 2026
👋 Hello! I noticed this issue might be related to existing issues:
Both share the key phrases:
api-proxy,BYOK,COPILOT_PROVIDER_API_KEY,Authorization header badly formatted, andexternal provider.If one of these addresses your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how your issue differs!
This is an automated message from the issue duplication detector.
lpcox commentedon May 8, 2026
Closing as duplicate — this is the same issue as #2665 and #2513, both already closed. Fixed in PR #2521 (
stripBearerPrefix()prevents double "Bearer" prefix) and PR #2598 (BYOK provider-env fallback).