From 0df077d5ca0225bf7c97a77c38b27fbaa15b487d Mon Sep 17 00:00:00 2001
From: n3d4 <13409428+boxplotinc@users.noreply.github.com>
Date: Wed, 19 Aug 2026 20:35:34 +0000
Subject: [PATCH] fix(anthropic): handle Authorization header
 case-insensitively

---
 litellm/llms/anthropic/common_utils.py         |  5 ++++-
 .../anthropic/test_anthropic_common_utils.py   | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/litellm/llms/anthropic/common_utils.py b/litellm/llms/anthropic/common_utils.py
index 1cdbd60f943..5233f3147b8 100644
--- a/litellm/llms/anthropic/common_utils.py
+++ b/litellm/llms/anthropic/common_utils.py
@@ -83,7 +83,10 @@ def optionally_handle_anthropic_oauth(headers: dict, api_key: str | None) -> tup
         Tuple of (updated headers, api_key)
     """
     # Check Authorization header (passthrough / forwarded requests)
-    auth_header: Final = headers.get("authorization", "")
+    auth_header: Final = next(
+        (value for key, value in headers.items() if key.lower() == "authorization"),
+        "",
+    )
     if auth_header and auth_header.startswith(f"Bearer {ANTHROPIC_OAUTH_TOKEN_PREFIX}"):
         api_key = auth_header.replace("Bearer ", "")
         headers.pop("x-api-key", None)
diff --git a/tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py b/tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py
index d205a903063..f5ca826e4c4 100644
--- a/tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py
+++ b/tests/test_litellm/llms/anthropic/test_anthropic_common_utils.py
@@ -47,6 +47,24 @@ class TestOptionallyHandleAnthropicOAuth:
         assert updated_headers["anthropic-dangerous-direct-browser-access"] == "true"
         assert "x-api-key" not in updated_headers
 
+    def test_oauth_token_in_capitalized_authorization_header(self):
+        """OAuth detection should treat HTTP header names as case-insensitive."""
+        from litellm.llms.anthropic.common_utils import (
+            optionally_handle_anthropic_oauth,
+        )
+
+        headers = {"Authorization": f"Bearer {FAKE_OAUTH_TOKEN}"}
+        updated_headers, extracted_api_key = optionally_handle_anthropic_oauth(
+            headers, None
+        )
+
+        assert extracted_api_key == FAKE_OAUTH_TOKEN
+        assert updated_headers["anthropic-beta"] == "oauth-2025-04-20"
+        assert (
+            updated_headers["anthropic-dangerous-direct-browser-access"] == "true"
+        )
+        assert "x-api-key" not in updated_headers
+
     def test_oauth_token_in_api_key_directly(self):
         """OAuth token passed as api_key should set Authorization: Bearer header."""
         from litellm.llms.anthropic.common_utils import (