Fix Anthropic-compatible auth headers

CHANGELOG.md

@@ -59,6 +59,11 @@ and this project does not yet follow semantic versioning (pre-1.0).
 
 ### Fixed
 
+- Anthropic route requests now send only `x-api-key` (plus `anthropic-version`)
+  for authentication and no longer also attach `Authorization: Bearer <apiKey>`.
+  Some Anthropic-compatible gateways reject requests that carry both headers.
+  Providers that genuinely require a bearer token can still supply one via
+  `extraHeaders`.
 - `codex-shim patch-app` now also patches the Codex Desktop sidebar's recent
   thread loader so native `openai` chats remain visible while Desktop is routed
   through the `codex_shim` provider. Tested on Codex Desktop 26.519.41501 /

codex_shim/server.py

@@ -1129,7 +1129,6 @@ def _anthropic_headers(route: ShimModel) -> dict[str, str]:
     }
     if route.api_key:
         headers.setdefault("x-api-key", route.api_key)
-        headers.setdefault("Authorization", f"Bearer {route.api_key}")
     return headers
 
 

tests/test_server.py

@@ -555,6 +555,7 @@ async def messages(request):
     assert payload["choices"][0]["message"]["content"] == "anthropic hello"
     assert captured["body"]["model"] == "claude-real"
     assert captured["headers"]["x-api-key"] == "secret"
+    assert "Authorization" not in captured["headers"]
 
     await shim_client.close()
     await upstream_client.close()