fix(anthropic): properly handle OAuth tokens (sk-ant-oat*) across all…

[tompipe]

Summary

OAuth tokens require Authorization header (not x-api-key) plus specific beta headers. This change:

• Adds is_anthropic_oauth_key() to detect OAuth token prefix (sk-ant-oat*)
• Adds set_anthropic_headers() to set correct auth header based on key type
• Updates optionally_handle_anthropic_oauth() to handle tokens from both Authorization header and direct api_key parameter
• Applies OAuth handling consistently across all Anthropic endpoints: batches, completion, count_tokens, files, skills, and pass-through
• Adds unit tests and manual integration test suite

Relevant issues

Fixes #19618

Pre-Submission checklist

• I have Added testing in the tests/litellm/ directory
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

🐛 Bug Fix

Changes

File	Change
litellm/llms/anthropic/common_utils.py	Added is_anthropic_oauth_key(), set_anthropic_headers(), updated optionally_handle_anthropic_oauth()
litellm/llms/anthropic/batches/transformation.py	Use set_anthropic_headers() for auth
litellm/llms/anthropic/completion/transformation.py	Use set_anthropic_headers() for auth
litellm/llms/anthropic/count_tokens/transformation.py	Use set_anthropic_headers() for auth
litellm/llms/anthropic/files/handler.py	Use set_anthropic_headers() for auth
litellm/llms/anthropic/skills/transformation.py	Use set_anthropic_headers() for auth
litellm/llms/anthropic/experimental_pass_through/messages/transformation.py	Use set_anthropic_headers() for auth
tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py	6 unit tests for OAuth handling
tests/test_litellm/llms/anthropic/test_anthropic_oauth_manual.py	Manual integration tests (skipped in CI)

Test plan

• Unit tests pass (poetry run pytest tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py -v)
• Manual integration tests verified with real OAuth token

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
litellm	Ready	Preview, Comment	Jan 27, 2026 0:02am

[CLAassistant]

All committers have signed the CLA.

[sasnong]

clean_headers function should be modified too, when you want to use the router for your anthropic llm calls (non-passthrough) - the code flow goes through clean_headers which should be modified to pass the auth header through

def clean_headers(
    headers: Headers, litellm_key_header_name: Optional[str] = None
) -> dict:
    """
    Removes litellm api key from headers
    """
    clean_headers = {}
    litellm_key_lower = (
        litellm_key_header_name.lower() if litellm_key_header_name is not None else None
    )

    for header, value in headers.items():
        header_lower = header.lower()
        # Preserve Authorization header if it contains Anthropic OAuth token (sk-ant-oat*)
        # This allows OAuth tokens to be forwarded to Anthropic-compatible providers
        # via add_provider_specific_headers_to_request()
        if header_lower == "authorization" and is_anthropic_oauth_key(value):
            clean_headers[header] = value
        # Check if header should be excluded: either in special headers cache or matches custom litellm key
        elif header_lower not in _SPECIAL_HEADERS_CACHE and (
            litellm_key_lower is None or header_lower != litellm_key_lower
        ):
            clean_headers[header] = value
    return clean_headers

[sasnong]

This would be the wrong place to add the header, if you have multiple providers listed in your router, it will forward the authentication header to all the providers listed in your router.

Authorization headers with Anthropic OAuth tokens (sk-ant-oat*) should be
        handled separately via add_provider_specific_headers_to_request() to ensure
        they only go to Anthropic-compatible providers.

function that should be modified is add_provider_specific_headers_to_request and it should be like:

def add_provider_specific_headers_to_request(
    data: dict,
    headers: dict,
):
    anthropic_headers = {}
    # boolean to indicate if a header was added
    added_header = False
    for header in ANTHROPIC_API_HEADERS:
        if header in headers:
            header_value = headers[header]
            anthropic_headers[header] = header_value
            added_header = True

    # Check for Authorization header with Anthropic OAuth token (sk-ant-oat*)
    # This needs to be handled via provider-specific headers to ensure it only
    # goes to Anthropic-compatible providers, not all providers
    for header, value in headers.items():
        if header.lower() == "authorization" and is_anthropic_oauth_key(value):
            anthropic_headers[header] = value
            added_header = True
            break

    if added_header is True:
        # Anthropic headers work across multiple providers
        # Store as comma-separated list so retrieval can match any of them
        data["provider_specific_header"] = ProviderSpecificHeader(
            custom_llm_provider=f"{LlmProviders.ANTHROPIC.value},{LlmProviders.BEDROCK.value},{LlmProviders.VERTEX_AI.value}",
            extra_headers=anthropic_headers,
        )

    return

[ghost]

• @jquinter for monitoring

[iamadamreed]

I've submitted an alternative fix in #19912 that implements the approach suggested in the review comments here. It's a minimal change that:

1. Adds is_anthropic_oauth_key() helper
2. Modifies clean_headers() to preserve OAuth Authorization header
3. Modifies add_provider_specific_headers_to_request() to forward OAuth via provider-specific headers

This ensures OAuth tokens only go to Anthropic-compatible providers (Anthropic/Bedrock/Vertex_AI), not all providers in the router.