From a60b09f117342f00f21f70e1266fd9cc02e45854 Mon Sep 17 00:00:00 2001 From: eafire15 Date: Tue, 2 Jun 2026 06:58:13 +1000 Subject: [PATCH 1/2] Fix Anthropic-compatible auth headers --- codex_shim/server.py | 1 - tests/test_server.py | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/codex_shim/server.py b/codex_shim/server.py index ff12957a..2c70b4a2 100644 --- a/codex_shim/server.py +++ b/codex_shim/server.py @@ -1129,7 +1129,6 @@ def _anthropic_headers(route: ShimModel) -> dict[str, str]: } if route.api_key: headers.setdefault("x-api-key", route.api_key) - headers.setdefault("Authorization", f"Bearer {route.api_key}") return headers diff --git a/tests/test_server.py b/tests/test_server.py index 9d743765..12756035 100644 --- a/tests/test_server.py +++ b/tests/test_server.py @@ -555,6 +555,7 @@ async def messages(request): assert payload["choices"][0]["message"]["content"] == "anthropic hello" assert captured["body"]["model"] == "claude-real" assert captured["headers"]["x-api-key"] == "secret" + assert "Authorization" not in captured["headers"] await shim_client.close() await upstream_client.close() From ef907c58cf4e73ece72d1e743c49be38baf983c6 Mon Sep 17 00:00:00 2001 From: OnlyTerp <121772140+OnlyTerp@users.noreply.github.com> Date: Mon, 1 Jun 2026 19:15:04 -0400 Subject: [PATCH 2/2] docs: changelog entry for Anthropic x-api-key-only auth --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 71887eeb..70f18a8a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,6 +59,11 @@ and this project does not yet follow semantic versioning (pre-1.0). ### Fixed +- Anthropic route requests now send only `x-api-key` (plus `anthropic-version`) + for authentication and no longer also attach `Authorization: Bearer `. + Some Anthropic-compatible gateways reject requests that carry both headers. + Providers that genuinely require a bearer token can still supply one via + `extraHeaders`. - `codex-shim patch-app` now also patches the Codex Desktop sidebar's recent thread loader so native `openai` chats remain visible while Desktop is routed through the `codex_shim` provider. Tested on Codex Desktop 26.519.41501 /