open-webui/backend/open_webui
Classic298 f8fe0cde9a fix: authenticate native Anthropic requests with x-api-key
The Anthropic Messages passthrough and the token-count forwarding both build their upstream request through `get_anthropic_request_target`, which sends the connection key as `Authorization: Bearer <key>`. Anthropic's OpenAI-compatible `/chat/completions` endpoint accepts that, which is why the model works in the chat UI, but the native `/v1/messages` and `/v1/messages/count_tokens` endpoints do not: they require the key in `x-api-key` and reject a bearer token with 401 `Invalid bearer token` (and `jwt auth is not yet supported on count_tokens`). They also require an `anthropic-version` header, which was never sent.

For `api.anthropic.com` connections, send `anthropic-version` and move the key into `x-api-key`, dropping the bearer header. Connections using session, OAuth or Entra ID auth keep their token untouched, LiteLLM passthrough connections are unaffected, and admin-configured custom headers still win over both defaults.

Fixes #27695
2026-07-29 18:47:45 +02:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal perf: route native JSON columns through JSONCodec instead of stdlib json (#28396) 2026-08-10 19:39:49 -05:00
migrations refac 2026-08-10 23:22:08 -06:00
models refac 2026-08-11 01:15:05 -06:00
retrieval refac 2026-08-10 23:40:31 -06:00
routers fix: authenticate native Anthropic requests with x-api-key 2026-07-29 18:47:45 +02:00
socket refac 2026-08-10 23:13:10 -06:00
static refac 2026-07-27 19:39:36 -04:00
storage refac 2026-07-31 17:41:14 -04:00
tools refac 2026-08-10 20:13:03 -06:00
utils fix: authenticate native Anthropic requests with x-api-key 2026-07-29 18:47:45 +02:00
__init__.py refac 2026-07-27 19:39:36 -04:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py refac 2026-08-11 01:15:05 -06:00
constants.py refac 2026-07-27 19:39:36 -04:00
env.py fix: make the aiodns resolver opt-in and pin aiodns to 3.6.1 (#28242) 2026-08-10 19:52:29 -06:00
events.py refac 2026-08-10 23:13:10 -06:00
functions.py perf: build debug log messages lazily so disabled debug logs cost nothing (#27834) 2026-07-31 19:09:01 -05:00
main.py fix: authenticate native Anthropic requests with x-api-key 2026-07-29 18:47:45 +02:00
tasks.py refac 2026-07-31 17:41:14 -04:00