[awf] api-proxy: malformed Authorization header when using COPILOT_PROVIDER_API_KEY with external providers (v0.71.4)

[lpcox]

Problem

Using BYOK with COPILOT_PROVIDER_API_KEY and COPILOT_PROVIDER_BASE_URL pointing to an external provider (e.g. OpenRouter) causes every api-proxy request to fail with 400 Authorization header is badly formatted. All 4 retries are exhausted and the agent run aborts.

Context

Original report: github/gh-aw#30169

Affected version: v0.71.4. Provider: OpenRouter ((openrouter.ai/redacted), model minimax/minimax-m2.5:free`.

Root Cause

The api-proxy sidecar (containers/api-proxy/) constructs the Authorization header incorrectly for external (non-Copilot) providers when COPILOT_PROVIDER_API_KEY is set. Likely the header value is being double-prefixed (Bearer Bearer sk-...) or the key value includes extra whitespace/encoding introduced during env var injection.

Proposed Solution

Audit the Authorization header construction in containers/api-proxy/ for the BYOK external-provider code path. Add an integration test that sets COPILOT_PROVIDER_BASE_URL to a mock server and verifies the forwarded Authorization header is exactly Bearer (key) with no duplication or extra characters. Fix the formatting bug and ensure it covers both OpenAI-compatible and Azure provider types.

Generated by Firewall Issue Dispatcher · ● 1.2M · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to existing issues:

• [awf] api-proxy: BYOK Authorization header badly formatted when forwarding to external provider #2513 - [awf] api-proxy: BYOK Authorization header badly formatted when forwarding to external provider — describes the same Authorization header is badly formatted error in the api-proxy BYOK code path for external providers
• BYOK mode fails when only COPILOT_PROVIDER_API_KEY is set (without COPILOT_API_KEY) #2597 - BYOK mode fails when only COPILOT_PROVIDER_API_KEY is set (without COPILOT_API_KEY) — related BYOK failure mode involving COPILOT_PROVIDER_API_KEY with external providers

If one of these addresses your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how your issue differs (e.g., the specific version regression or the Bearer Bearer double-prefix behavior)!

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #2665 · ● 211K · ◷

[lpcox]

Closing as duplicate of #2513 (fixed in PR #2521 and PR #2598, both merged).

The stripBearerPrefix() function in containers/api-proxy/providers/copilot.js already strips any accidental "Bearer " prefix from COPILOT_API_KEY, and the proxy's STRIPPED_HEADERS set ensures the agent's outgoing Authorization header is removed before the provider's injected header is applied. The BYOK auth path is working correctly in current main.