fix(anthropic): handle Authorization header case-insensitively

litellm/llms/anthropic/common_utils.py

@@ -83,7 +83,10 @@ def optionally_handle_anthropic_oauth(headers: dict, api_key: str | None) -> tup
         Tuple of (updated headers, api_key)
     """
     # Check Authorization header (passthrough / forwarded requests)
-    auth_header: Final = headers.get("authorization", "")
+    auth_header: Final = next(
+        (value for key, value in headers.items() if key.lower() == "authorization"),
+        "",
+    )
     if auth_header and auth_header.startswith(f"Bearer {ANTHROPIC_OAUTH_TOKEN_PREFIX}"):
         api_key = auth_header.replace("Bearer ", "")
         headers.pop("x-api-key", None)

tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py

@@ -47,6 +47,24 @@ class TestOptionallyHandleAnthropicOAuth:
         assert updated_headers["anthropic-dangerous-direct-browser-access"] == "true"
         assert "x-api-key" not in updated_headers
 
+    def test_oauth_token_in_capitalized_authorization_header(self):
+        """OAuth detection should treat HTTP header names as case-insensitive."""
+        from litellm.llms.anthropic.common_utils import (
+            optionally_handle_anthropic_oauth,
+        )
+
+        headers = {"Authorization": f"Bearer {FAKE_OAUTH_TOKEN}"}
+        updated_headers, extracted_api_key = optionally_handle_anthropic_oauth(
+            headers, None
+        )
+
+        assert extracted_api_key == FAKE_OAUTH_TOKEN
+        assert updated_headers["anthropic-beta"] == "oauth-2025-04-20"
+        assert (
+            updated_headers["anthropic-dangerous-direct-browser-access"] == "true"
+        )
+        assert "x-api-key" not in updated_headers
+
     def test_oauth_token_in_api_key_directly(self):
         """OAuth token passed as api_key should set Authorization: Bearer header."""
         from litellm.llms.anthropic.common_utils import (