[awf] api-proxy: malformed Authorization header with COPILOT_PROVIDER_API_KEY (BYOK, v0.71.4)

[lpcox]

Problem

When using BYOK with COPILOT_PROVIDER_API_KEY and an external provider base URL (e.g., OpenRouter), every request via the api-proxy fails with 400: Authorization header is badly formatted. All retries fail, causing the entire agent run to abort.

Context

Upstream: github/gh-aw#30169

• gh-aw v0.71.4, ubuntu-24.04
• `COPILOT_PROVIDER_BASE_URL: (openrouter.ai/redacted)
• Model: minimax/minimax-m2.5:free

Root Cause

The api-proxy in containers/api-proxy/ likely double-encodes or mis-formats the Authorization header when injecting COPILOT_PROVIDER_API_KEY — possibly prepending Bearer to a value that already contains it, or incorrectly concatenating with another header.

Proposed Solution

1. Audit the Authorization header construction in containers/api-proxy/ — ensure the injected key is formatted as Bearer (raw_key) with no duplication.
2. Add a unit test for header injection with a raw API key value.
3. Add an integration test against a mock external provider endpoint to verify header format.

Generated by Firewall Issue Dispatcher · ● 1.2M · ◷

[github-actions]

👋 Hello! I noticed this issue might be related to existing issues:

• [awf] api-proxy: malformed Authorization header when using COPILOT_PROVIDER_API_KEY with external providers (v0.71.4) #2665 - Nearly identical title: "api-proxy: malformed Authorization header when using COPILOT_PROVIDER_API_KEY with external providers (v0.71.4)" — same component, same symptom, same version
• [awf] api-proxy: BYOK Authorization header badly formatted when forwarding to external provider #2513 - "api-proxy: BYOK Authorization header badly formatted when forwarding to external provider" — same core problem of badly formatted Authorization header in BYOK mode

Both share the key phrases: api-proxy, BYOK, COPILOT_PROVIDER_API_KEY, Authorization header badly formatted, and external provider.

If one of these addresses your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how your issue differs!

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #2703 · ● 141.2K · ◷

[lpcox]

Closing as duplicate — this is the same issue as #2665 and #2513, both already closed. Fixed in PR #2521 (stripBearerPrefix() prevents double "Bearer" prefix) and PR #2598 (BYOK provider-env fallback).