Repository navigation
[awf] api-proxy/copilot: Authorization header malformed with COPILOT_PROVIDER_API_KEY for external providers #2806
Description
Problem
When using BYOK with COPILOT_PROVIDER_API_KEY and an external provider base URL (e.g. OpenRouter), all inference requests fail with 400 bad request: Authorization header is badly formatted. The api-proxy health check passes, confirming offline+BYOK mode is detected, but every request fails immediately.
Context
Original issue: github/gh-aw#30169
Root Cause
In containers/api-proxy/providers/copilot.js, the Authorization header is likely being constructed incorrectly — e.g. double Bearer prefix, wrong casing, or the header value being URL-encoded or otherwise malformed. The bug was introduced in or before v0.71.4 and affects all external providers (confirmed with OpenRouter).
Proposed Solution
In containers/api-proxy/providers/copilot.js, audit how COPILOT_PROVIDER_API_KEY is injected into the Authorization header. Ensure the format is exactly Bearer <key> with no double prefix. Add an integration test that spins up the api-proxy with a mock external provider and verifies the forwarded Authorization header format.
Generated by Firewall Issue Dispatcher · ● 876.2K · ◷
Activity
github-actions commentedon May 9, 2026
👋 Hello! I noticed this issue might be related to existing issues:
All of these describe the same
Authorizationheader formatting bug inapi-proxywhen usingCOPILOT_PROVIDER_API_KEYwith external providers. If one of these addresses your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how your issue differs!This is an automated message from the issue duplication detector.
lpcox commentedon May 9, 2026
Resolved by commit 899ee4b which added
stripBearerPrefix()helper incontainers/api-proxy/providers/copilot.js. The doubleBearer Bearer <key>issue is fixed and tested.