Skip to content

[v3.8.50] fix(auth): accept x-api-key without anthropic-version for claude-code user-agent (fixes #8655) #8678

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
diegosouzapw merged 3 commits into from
Aug 6, 2026
+22 −3
Merged

[v3.8.50] fix(auth): accept x-api-key without anthropic-version for claude-code user-agent (fixes #8655) #8678

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d0db157
fix(auth): accept x-api-key without anthropic-version for claude-code…
Jul 26, 2026
c0999d2
Merge remote-tracking branch 'origin/release/v3.8.50' into HEAD
diegosouzapw Aug 4, 2026
aed39cf
chore: merge release/v3.8.50 into pr/fix-claude-code-x-api-key
Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions src/sse/services/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2464,13 +2464,16 @@ export function extractApiKey(request: AuthRequestLike, opts?: { allowUrl?: bool
}

// Issue #2225: Anthropic Messages API clients authenticate via x-api-key.
// Gate the fallback on the anthropic-version header so we don't trip up
// local-mode requests from non-Anthropic clients that send placeholder
// Gate the fallback on anthropic-version OR a claude-code/anthropic user-agent so we
// don't trip up local-mode requests from non-Anthropic clients that send placeholder
// x-api-key values (which would otherwise be rejected as Invalid API key).
const anthropicVersion =
readHeaderValue(request?.headers, "anthropic-version") ||
readHeaderValue(request?.headers, "Anthropic-Version");
if (anthropicVersion) {
const userAgent =
readHeaderValue(request?.headers, "user-agent") ||
readHeaderValue(request?.headers, "User-Agent");
if (anthropicVersion || (userAgent && /claude-code|claude-cli|anthropic/i.test(userAgent))) {
const xApiKey =
readHeaderValue(request?.headers, "x-api-key") ||
readHeaderValue(request?.headers, "X-Api-Key");
Expand Down
16 changes: 16 additions & 0 deletions tests/unit/auth-extract-api-key.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,22 @@ test("extractApiKey extracts a path-scoped token from /api/v1/vscode/combos/<tok
assert.equal(extractApiKey(req), "sk-test-path-token");
});

test("extractApiKey accepts x-api-key without anthropic-version when User-Agent is claude-code (#8655)", () => {
const req = makeRequest({
"x-api-key": "sk-omniroute-test-key",
"User-Agent": "claude-code/0.2.29 node/v20.18.0 darwin-x64",
});
assert.equal(extractApiKey(req), "sk-omniroute-test-key");
});

test("extractApiKey accepts x-api-key without anthropic-version when User-Agent is @anthropic-ai/sdk (#8655)", () => {
const req = makeRequest({
"x-api-key": "sk-omniroute-test-key",
"User-Agent": "anthropic-typescript/0.25.0",
});
assert.equal(extractApiKey(req), "sk-omniroute-test-key");
});

test("extractApiKey does NOT extract a query-string token (#3300 security follow-up)", () => {
// Query-string fallbacks (?token / ?key / ?apiKey / ?api_key) were removed —
// a credential in the query string leaks into access logs / Referer headers.
Expand Down
Loading