Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This fixes Anthropic-native
/v1/messages/count_tokensrequests when the inbound client authenticates withAuthorizationinstead ofx-api-key.Problem
A request came in on
/v1/messages/count_tokensthrough the Anthropic wire format and reached an Anthropic-compatible relay that requiresAuthorization: Bearer .... Token Proxy resolved the upstream asprovider=anthropic, but the proxy layer always rewrote Anthropic upstream auth tox-api-key, which caused the relay to reject the forwarded request withRequired request header 'Authorization' ... is not present.Root Cause
resolve_request_authonly retained Anthropic credential values, not the original inbound header name. Later,resolve_upstream_authunconditionally emittedx-api-keyfor every Anthropic provider, even when the inbound Anthropic-native request had arrived withAuthorizationand the target upstream expected that same header name.Fix
The proxy now records the original auth header shape for Anthropic-native inbound paths (
Authorization,x-api-key, orx-anthropic-api-key). When forwarding to an Anthropic provider, Token Proxy preserves that header name and only replaces the value with the configured upstream key when one exists. Non-Anthropic-native inbound paths keep the old fallback behavior so OpenAI/Gemini conversion paths are not changed accidentally.Validation
I ran:
cargo test -p token_proxy_corecargo test -p token_proxy_core proxy::http::tests -- --nocapturecargo test -p token_proxy_core anthropic_count_tokens_preserves_authorization_header_name_for_upstream -- --nocapturecargo test -p token_proxy_core anthropic_upstream_auth_reuses_x_api_key_header_name_with_upstream_key -- --nocapturecargo fmt --all --check