fix: add Anthropic WIF beta headers - #6890
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563
Contributor
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Anthropic WIF beta headers to JWT exchanges and bearer-authenticated requests.
Changes:
- Adds and merges required Anthropic beta headers.
- Enables OIDC validation and model discovery.
- Expands tests and authentication documentation.
Show a summary per file
| File | Description |
|---|---|
docs/authentication-architecture.md |
Documents beta-header routing. |
docs/auth-matrix.md |
Updates WIF behavior matrix. |
docs/api-proxy-sidecar.md |
Documents sidecar header contract. |
containers/api-proxy/server.custom-auth-header.test.js |
Updates custom-header expectations. |
containers/api-proxy/providers/anthropic.js |
Merges bearer, client, and cache betas. |
containers/api-proxy/anthropic-oidc-token-provider.test.js |
Tests exchange headers. |
containers/api-proxy/anthropic-oidc-token-provider.js |
Adds federation exchange headers. |
containers/api-proxy/anthropic-adapter-auth.test.js |
Covers request-header behavior. |
containers/api-proxy/adapter-factory.js |
Supports non-key credentials for startup operations. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 9/9 changed files
- Comments generated: 1
- Review effort level: Balanced
Comment on lines
+89
to
+91
| if (new URL(this._tokenEndpoint).pathname === '/v1/oauth/token') { | ||
| headers['anthropic-beta'] = `${OAUTH_API_BETA},${OIDC_FEDERATION_BETA}`; | ||
| } |
Collaborator
Author
|
@copilot address review feedback |
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
Contributor
Done in |
lpcox
added a commit
that referenced
this pull request
Aug 3, 2026
* docs: update authentication and API proxy guidance Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * fix: add Anthropic WIF beta headers (#6890) * fix: add Anthropic WIF beta headers Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563 * fix: apply WIF beta headers unconditionally in _exchangeForAnthropicToken --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563 * feat: sign AWS Bedrock requests with SigV4 (#6891) * feat: sign AWS Bedrock requests with SigV4 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5 * fix: reframe rewritten fallback requests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5 --------- Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5 * docs: correct authentication trust boundaries Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * fix: isolate Actions OIDC from agent container (#6894) * fix: isolate Actions OIDC from agent Keep GitHub Actions OIDC request credentials in the API proxy sidecar. Prevent default, env-all, env-file, and explicit environment paths from exposing them to untrusted agent code. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * docs: clarify OIDC agent credential boundary * docs: align OIDC isolation with MCP gateway Describe the runner-owned gateway flow generated by gh-aw and add direct regression coverage for env-file credential exclusion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * fix: update brace-expansion to 5.0.9 Resolve GHSA-rgw5-rvv9-x895 in the main package dependency tree. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563 Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Stack
Targets
update-auth-proxy-docsand should be merged after that base PR.