Allow custom headers for BYOK

[ZzetT]

Describe the feature or problem you'd like to solve

Some LLM servers require specific headers to be sent, allow to set custom http(s) headers
Examples could be:

• X-Tenant-ID / X-Organization-ID: Identifies which company or sub-organization is making the request to ensure their specific data boundaries and rate limits are respected.
• X-User-ID: Tracks usage down to the individual employee or end-user, often used to prevent a single user from exhausting the company's API quota.
• X-Fallback-Models: Instructs the gateway on what to do if the primary model is down
• X-Cache-Bypass: Forces the server to ignore the cache and generate a fresh response from the LLM. Useful for testing or if the LLM is expected to return real-time data.
• anthropic-beta: Anthropic frequently uses this to enable experimental features

Proposed solution

Add COPILOT_EXTRA_HEADERS (or COPILOT_CUSTOM_HEADERS) to set one ore multiple headers in the format "Name: Value" (newline for multiple headers)

Filter out headers Authorization or x-api-key (or do not allow them)

Example prompts or workflows

export COPILOT_EXTRA_HEADERS="X-Tenant-ID: 1234\nX-Proxy-Bypass: true"

Additional context

No response

[mukeshgurpude]

Is this being worked on?

[brenwhyte]

Strong +1 on this from an enterprise perspective — specifically the anthropic-beta example mentioned in the description is exactly our blocker.

Our use case: We run a self-hosted Portkey AI gateway in front of AWS Bedrock, AzureAI and Vertex AI used by hundreds of developers across multiple teams. The gateway handles auth, EU data residency, cost attribution, and observability via custom headers. BYOK is almost perfect for routing Copilot CLI through this infrastructure, but two headers are currently unsendable:

• anthropic-beta: context-1m-2025-08-07,interleaved-thinking-2025-05-14 — without this, Claude Sonnet 4.6 and Opus 4.8 are capped at 200K tokens through our gateway even though the models support 1M. This is the header Anthropic uses to unlock extended context on Bedrock. Without it, developers using Copilot CLI BYOK get a worse context experience than developers using OpenCode with our gateway config, which can send headers freely.
• x-portkey-api-key — our gateway resolves provider credentials and routing from this header. Without it, requests fall back to less specific virtual key resolution.

The proposed COPILOT_EXTRA_HEADERS env var (in the Name: Value\n format) would solve both completely. The security consideration of filtering out Authorization and x-api-key makes sense — those are already handled by COPILOT_PROVIDER_API_KEY.

As an alternative shape: a COPILOT_EXTRA_HEADERS that accepts a JSON object might be slightly easier to parse for multi-value headers, though the newline format is simpler to set in shell profiles:

# Newline format (as proposed)
export COPILOT_EXTRA_HEADERS="anthropic-beta: context-1m-2025-08-07,interleaved-thinking-2025-05-14\nx-portkey-api-key: my-key"

# JSON alternative
export COPILOT_EXTRA_HEADERS='{"anthropic-beta":"context-1m-2025-08-07","x-portkey-api-key":"my-key"}'

Either works for our use case. The newline format is probably more shell-friendly for most users. Happy to test any beta implementation against our setup if that would help validate the feature.

[cf-rdegregory]

I strongly agree with @brenwhyte, this is pretty essential for enterprises running their own AI Gateways...including Microsoft's own AI Gateway Azure API Management (APIM).

I've already submitted this same issue in the VS Code repository: microsoft/vscode#317810.

They knocked it out within a day...shouldn't be too hard to do the same here, right? 😄