BYOK: Authorization header is badly formatted when using COPILOT_PROVIDER_API_KEY with external provider (v0.71.4)

[MauroDruwel]

Bug Report

Description

When using BYOK (Bring Your Own Key) with COPILOT_PROVIDER_API_KEY and COPILOT_PROVIDER_BASE_URL pointing to an external provider (e.g. OpenRouter), every request to the api-proxy fails with:

400 400 bad request: Authorization header is badly formatted

This happens on every attempt (all 4 retries exhaust), causing the entire agent run to fail.

Environment

• gh-aw version: v0.71.4
• Runner image: ubuntu-24.04 (20260413.86.1)
• Model: minimax/minimax-m2.5:free (via OpenRouter)
• COPILOT_PROVIDER_BASE_URL: https://openrouter.ai/api/v1

Steps to Reproduce

1. Set COPILOT_PROVIDER_BASE_URL and COPILOT_PROVIDER_API_KEY in the workflow .md config file for BYOK mode.
2. Trigger the agentic workflow.
3. Observe the agent container logs.

Observed Behavior

The health check passes and correctly identifies offline+BYOK mode:

[health-check] ✓ COPILOT_PROVIDER_API_KEY is placeholder value (correct)
[health-check] COPILOT_PROVIDER_BASE_URL=http://172.30.0.30:10002 (offline+BYOK mode)
[health-check] ✓ Copilot CLI offline+BYOK mode configured
[health-check] ✓ All API proxy health checks passed

But all inference requests immediately fail:

● Request failed (transient_bad_request). Retrying...
● Request failed (transient_bad_request). Retrying...

400 400 bad request: Authorization header is badly formatted

Additionally, the models endpoint also returns 400:

[copilot-harness] awf-reflect: models fetch returned 400 for http://api-proxy:10002/models

The harness does not classify this as an auth error (isAuthError=false), so all 3 retries are consumed before giving up:

[copilot-harness] attempt 4 failed: exitCode=1 isCAPIError400=false isMCPPolicyError=false isModelNotSupportedError=false isNullTypeToolCallError=false isAuthError=false hasOutput=true retriesRemaining=0
[copilot-harness] all 3 retries exhausted — giving up (exitCode=1)

Expected Behavior

The api-proxy sidecar should correctly inject the COPILOT_PROVIDER_API_KEY as a properly formatted Authorization: Bearer <key> header when proxying requests to the external provider URL.

Additionally, a badly-formatted Authorization header (400 from the upstream provider) should ideally be classified as a non-retryable auth error to fail fast rather than exhausting all retries.

Additional Context

• The COPILOT_API_KEY env var inside the container is correctly set to the dummy-byok-key-for-offline-mode placeholder.
• The actual provider key (COPILOT_PROVIDER_API_KEY) is held securely in the sidecar proxy container.
• The issue appears to be in how the sidecar proxy formats the Authorization header when forwarding requests upstream to the external provider.

[MauroDruwel]

Additional context:

The env variables are configured exactly as documented/recommended in a prior issue. The .md workflow file has:

engine:
  id: copilot
  env:
    # REQUIRED — Activates BYOK mode (without this, uses GitHub Copilot routing)
    COPILOT_PROVIDER_BASE_URL: ${{ vars.PROVIDER_BASE_URL }}

    # REQUIRED — A model must be specified (via this, --model, or COPILOT_PROVIDER_MODEL_ID)
    COPILOT_MODEL: ${{ vars.PROVIDER_MODEL }}

    # OPTIONAL — Not needed for local providers (Ollama, vLLM); required for cloud APIs
    COPILOT_PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}

All three variables (vars.PROVIDER_BASE_URL, vars.PROVIDER_MODEL, secrets.PROVIDER_API_KEY) are set in the repository settings. The configuration matches what was advised in a prior issue, yet BYOK still fails with the Authorization header is badly formatted error in v0.71.4.

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#2513

Generated by Firewall Issue Dispatcher · ● 569.4K · ◷

[MauroDruwel]

I'm still having the same issue after upgrading to this new version. How can I debug this further?