[Bug]: Unable to use Claude Code BYOK when ANTHROPIC_AUTH_TOKEN is set/with non-anthropic claude model providers

[saraangelmurphy]

Check for existing issues

• I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

A bug happened!

I am trying to set up LiteLLM with my company's claude enterprise subscription. Prior to purchasing claude enterprise, we used LiteLLM with Claude Code successfully, with models from both Anthropic, as well as from AWS Bedrock, GCP Vertex, and Azure OpenAI.

I'm running litellm in kubernetes with two pods in HA using an in-cluster redis for synchronization.

I'm trying to set up LiteLLM and Claude Code now using the OAuth token from the /login command from Claude Code.

This... sometimes works! However, it seems to work very inconsistently, and I am unable to easily swap between Claude models (using my subscription OR API billing), Claude models from Bedrock and Vertext (using API billing), and non-Claude models (using API billing).

Steps to Reproduce

1. set up the relevant anthropic models. In general, assume that I have set up claude-<opus/sonnet>-<4-5/4-6>, claude-haiku-4-5 with both the anthropic provider and vertex/bedrock.

general_settings:
  allow_requests_on_db_unavailable: true
  database_connection_pool_limit: 10
  forward_client_headers_to_llm_api: true
  forward_llm_provider_auth_headers: true
  master_key: os.environ/LITELLM_MASTER_KEY
  proxy_batch_write_at: 60
  store_model_in_db: true
litellm_settings:
  cache: true
  cache_params:
    host: os.environ/REDIS_HOST
    password: os.environ/redis-password
    port: os.environ/REDIS_PORT
    ttl: 600
    type: redis
  callbacks:
  - batch_redis_requests
  - prometheus
  drop_params: true
  enable_caching_on_provider_specific_optional_params: true
  enable_preview_features: true
  json_logs: false
  key_generation_settings:
    personal_key_generation:
      required_params:
      - duration
  num_retries: 2
  prometheus_initialize_budget_metrics: true
  request_timeout: 600
  turn_off_message_logging: true
model_list:
- litellm_params:
    model: '*'
  model_name: '*'
- litellm_params:
    model: anthropic/claude-opus-4-6
  model_info:
    access_groups:
    - Standard Model Group
    mode: chat
  model_name: claude-opus-4-6
- litellm_params:
    model: anthropic/claude-opus-4-6-20260205
  model_info:
    access_groups:
    - Standard Model Group
    mode: chat
  model_name: claude-opus-4-6-20260205
- litellm_params:
    model: vertex_ai/gemini-3.1-pro-preview
    use_in_pass_through: true
    vertex_credentials: os.environ/GOOGLE_SA_KEYFILE_PATH
    vertex_location: global
    vertex_project: <my-gcp-project-id>
  model_info:
    access_groups:
    - Standard Model Group
    mode: chat
  model_name: gemini-3.1-pro-preview
- litellm_params:
    api_base: <my azure openai endpoint>
    api_key: os.environ/BV-OPENAI-GPT-KEY
    api_version: os.environ/AZURE_OPENAI_INFERENCE_API_VERSION
    model: azure/gpt-5.2
  model_info:
    access_groups:
    - Standard Model Group
    base_model: azure/gpt-5.2
    mode: chat
  model_name: gpt-5.2
- litellm_params:
    cache_control_injection_points:
    - location: message
      role: system
    model: vertex_ai/claude-sonnet-4-6
    use_in_pass_through: true
    vertex_credentials: os.environ/GOOGLE_SA_KEYFILE_PATH
    vertex_location: global
    vertex_project: <my gcp project id>
  model_info:
    access_groups:
    - Standard Model Group
    mode: chat
  model_name: claude-sonnet-4-6
- litellm_params:
    cache_control_injection_points:
    - location: message
      role: system
    model: vertex_ai/claude-opus-4-6
    use_in_pass_through: true
    vertex_credentials: os.environ/GOOGLE_SA_KEYFILE_PATH
    vertex_location: global
    vertex_project: <my gcp project>
  model_info:
    access_groups:
    - Standard Model Group
    mode: chat
  model_name: claude-opus-4-6

2. set the envvars:

export ANTHROPIC_BASE_URL=https://litellm.example.com
export ANTHROPIC_DEFAULT_OPUS_MODEL=claude-opus-4-6
export ANTHROPIC_AUTH_TOKEN=sk-1234
export ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: Bearer sk-1234"
export CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1

3. run claude --debug
4. run /login with your anthropic credentials, which returns successfully
5. If ANTHROPIC_AUTH_TOKEN is unset, then:

• I think the issue depends on whether LiteLLM decides to route the request to the Anthropic instance of claude-opus-4-6/claude-sonnet-4-6 vs the bedrock/vertex instances
• requests to claude-opus-4-6 fail with the following BaseLLMException.

Please run /login · API Error: 403 {"error":{"message":"{\"message\":\"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): '<redacted>.\"}. Received Model
     Group=claude-opus-4-6\nAvailable Model Group Fallbacks=None","type":"None","param":"None","code":"403"}}

• requests to anthropic models that are non-default but are present in the model_prices_and_context_window.json (e.g. claude-opus-4-6-20260205 or claude-haiku-4-5-20251001 ) fail with Model 'claude-opus-4-6-20260205' not found.
• requests to non-anthropic models like gemini-3.1-flash-lite-preview work when running /model gemini-3.1-flash-lite-preview
• Switching back to claude models is inconsistent.
• /model claude-haiku-4-5, /model claude-sonnet-4-6, and /model claude-sonnet-4-5 all fail with Please run /login
• /model claude-opus-4-6 fails with API error: 403 {"error":{"message":"{"message":"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): '<snip>'."}. Received Model Group=claude-opus-4-6\nAvailable Model Group Fallbacks=None","type":"None","param":"None","code":"403"}} but no Please run /login error
• /model claude-opus-4-5 works, bizarrely.
• all of these models work some of the time. I occasionally get back correct results, but frequently get the Invalid key=value pair error as well.

7. If ANTHROPIC_AUTH_TOKEN is set, then:

• /model and picking the default model works, uses anthropic/claude-opus-4-6
• /model and picking Sonnet (1M context) works
• requests to models like claude-haiku-4-5-20251001 fail with Authentication failed. Please check your API credentials. and 401 errors with the text Message: {"type":"error","error":{"type":"authentication_error","message":"x-api-key header is required"},"request_id":"req_011CZLUcjtvRigLeHDYhr3aU"} in the proxy logs
• Requests to models like gemini-3.1-pro-preview work fine.
• Requests are routed to bedrock/vertex even after running /login, unless bedrock and vertex claude models are disabled.
• Calls to bedrock and vertex models fail with API error: 403 {"error":{"message":"{"message":"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): 'BnNmwEPz6udl6PPQjBc79nhwawpKIppOZa0kHg5vTpg='."}. Received Model Group=claude-sonnet-4-5-bedrock\nAvailable Model Group Fallbacks=None","type":"None","param":"None","code":"403"}} when claude code thinks I'm in Claude Enterprise mode, and of course work fine when it's not trying to send my anthropic oauth token instead of litellm's bedrock/vertex creds. It is again inconsistent as to when LiteLLM does that or not.

Relevant log output

{"message":"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): 'nAMAupSMCgnLYhCwe9U7NxImj3fxMrOJZ8X1E/XwEOQ='."}

What part of LiteLLM is this about?

Proxy

What LiteLLM version are you on ?

v1.82.3

Twitter / LinkedIn details

No response

[saraangelmurphy]

One option is to use the anthropic models by default, configure bedrock and vertex models with a -bedrock and -vertex suffix, and add them as fallback models. Unfortunately that would break programmatic non oauth token based invocations to those existing models.

edit: this also doesn't work. /model claude-sonnet-4-5-bedrock fails with API error: 403 {"error":{"message":"{"message":"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): 'RT4P0Ut4mKyJ6FDzyBT+3FPSuAkxJsGal1/n3KVb9w8='."}. Received Model Group=claude-sonnet-4-5-bedrock\nAvailable Model Group Fallbacks=None","type":"None","param":"None","code":"403"}} which pretty conclusively proves that the earlier issue is queries getting routed to the wrong provider using the wrong credentials.

[saraangelmurphy]

Finally, the behaviour is inconsistent with non-claude models.

e.g. gemini works fine when ANTHROPIC_AUTH_TOKEN is unset and /login is run interactively:

➜  scratch claude -p "whatmodelareyou123" --model gemini-3.1-flash-lite-preview
I am powered by the Gemini 3.1 Flash Lite Preview model.

but glm-5, also hosted by vertex in the same gcp project does not work:

Error Code: 401
Message: litellm.AuthenticationError: Vertex_aiException - [{ "error": { "code": 401, "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.", "status": "UNAUTHENTICATED", "details": [ { "@type": "type.googleapis.com/google.rpc.ErrorInfo", "reason": "ACCESS_TOKEN_TYPE_UNSUPPORTED", "metadata": { "method": "google.cloud.aiplatform.v1.PredictionService.ChatCompletions", "service": "aiplatform.googleapis.com" } } ] } } ]. Received Model Group=glm-5 Available Model Group Fallbacks=None

everything works a-ok when called from outside of claude code:

➜  scratch curl --location https://litellm.example.com/chat/completions --header 'Content-Type: application/json' --header "Authorization: Bearer $LITELLM_DEV_API_KEY" --data @data.json  | jq .
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3723  100  3526  100   197    315     17  0:00:11  0:00:11 --:--:--   887
{
  "id": "jpnBaa-1NtnCueUPh6no2AY",
  "created": 1774295447,
  "model": "glm-5",
  "object": "chat.completion",
  "choices": [
    {
      "finish_reason": "stop",
      "index": 0,
      "message": {
        "content": "Pi to four decimal places is **3.1416**.\n\n(The digits are 3.14159265..., so the fourth digit is 5, but the fifth digit is 9, which causes the rounding up).",
        "role": "assistant",
        "reasoning_content": "The user is asking for the value of pi to four decimal places.\n\n1.  **Recall/Calculate Pi:** I know that $\\pi$ is an irrational number approximately equal to 3.14159265...\n\n2.  **Determine the format:**\n    *   The user wants \"four decimals\".\n    *   The digits are: 3 . 1 4 1 5 9...\n    *   The fourth decimal place is the '5'.\n    *   The digit after the fourth decimal place is '9'.\n\n3.  **Rounding Rule:**\n    *   If the digit following the cutoff point is 5 or greater, round up.\n    *   If it is less than 5, keep it the same.\n    *   Here, the sequence is 3.1415 *9*.\n    *   The 9 is greater than 5, so I need to round the 5 up to 6.\n\n4.  **Verification:**\n    *   3.1415... -> The next digit is 9.\n    *   Rounding 3.14159 to 4 decimal places:\n        *   1st decimal: 1\n        *   2nd decimal: 4\n        *   3rd decimal: 1\n        *   4th decimal: 5 (needs to be rounded because the next digit is 9).\n    *   So, 3.1416.\n\n5.  **Wait, let me double-check standard interpretation.**\n    *   Often, when people ask \"pi to four decimals\", they might mean \"list the first four digits after the decimal point\".\n    *   Digits: 1, 4, 1, 5.\n    *   Result: 3.1415.\n    *   However, strictly speaking, \"to four decimal places\" implies rounding.\n    *   Let's look at the actual number: 3.14159265...\n    *   To four decimal places (rounded): 3.1416.\n    *   Truncated to four decimal places: 3.1415.\n\n    *   *Self-Correction/Refinement:* In most mathematical or general contexts, \"to [x] decimal places\" means rounding to that precision.\n    *   Let's check the digit at the 5th place. It is 9.\n    *   $3.1415 + 0.0001 = 3.1416$.\n\n    *   Let's try to be clear. If I say 3.1416, it is the rounded value. If I say 3.1415, it is the truncated value. Standard convention is rounding.\n\n    *   Let's provide the rounded value as it is the standard mathematical definition.\n    *   $\\pi \\approx 3.14159...$\n    *   Round to 4 places: 3.1416.\n\n    *   *Alternative Interpretation:* Sometimes users just want to memorize the string \"3.1415\". However, accuracy dictates rounding.\n    *   Let's provide the answer 3.1416, but perhaps note the rounding if necessary? No, usually a direct answer is best.\n    *   Let's re-verify.\n    *   Pi = 3.1415926535...\n    *   1st decimal: 1\n    *   2nd decimal: 4\n    *   3rd decimal: 1\n    *   4th decimal: 5\n    *   5th decimal: 9\n    *   Since 9 >= 5, round up.\n    *   Result: 3.1416.\n\n    *   Is there any ambiguity? \"Four decimals\" usually implies precision.\n    *   I will provide the rounded value.\n\n6.  **Drafting the response:**\n    *   \"Pi to four decimal places is 3.1416.\"\n\n7.  **Final check:**\n    *   User asked: \"what is pi to four decimals?\"\n    *   Response: 3.1416.\n\n    (If I answered 3.1415, I would be truncating, which is technically incorrect for \"decimal places\" terminology, though common in casual memorization).\n\n    Let's stick to the mathematically correct rounded version."
      }
    }
  ],
  "usage": {
    "completion_tokens": 954,
    "prompt_tokens": 20,
    "total_tokens": 974,
    "extra_properties": {
      "google": {
        "traffic_type": "ON_DEMAND"
      }
    }
  }
}

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.