[wcqqq1214]

Fixes #10786. Anthropic SDK 2.x sends Bearer auth, leaving compatible endpoints that require X-Api-Key unable to authenticate.

Modifications / 改动点

• Explicitly send X-Api-Key, preserve custom values, and normalize casing to avoid duplicate headers with older SDKs.

• Add focused regression coverage for default and custom API key headers.

• This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

61 tests passed with each SDK version (0.116.0 and 2.3.0):

.venv/bin/python -m pytest tests/test_anthropic_source.py tests/test_anthropic_kimi_code_provider.py -q
uv run --no-sync --with 'anthropic==2.3.0' python -m pytest tests/test_anthropic_source.py tests/test_anthropic_kimi_code_provider.py -q

ruff format ., ruff check ., and git diff --check passed. HTTP requests were mocked; no live OpenCode credentials were used.

---

Checklist / 检查清单

• 😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
  / 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。

• 👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
  / 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。

• 📚 I checked the affected WebUI instructions and screenshots in docs/zh and docs/en against the changed navigation, page structure, and labels, and updated them in this PR (or explained why no documentation update is needed). For renamed, moved, or merged entry points, I included an old entry → new entry mapping in the documentation and changelog.
  / 我已对照变化后的 WebUI 入口、页面结构和术语，核对并在本 PR 中更新 docs/zh 和 docs/en 的相关操作说明与截图（或说明无需更新文档的原因）。入口改名、移动或合并时，已在文档和 changelog 中补充 旧入口 → 新入口 对照。

• 🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
  / 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到 requirements.txt 和 pyproject.toml 文件相应位置。

• 😮 My changes do not introduce malicious code.
  / 我的更改没有引入恶意代码。

Summary by Sourcery

Ensure Anthropic-compatible endpoints continue to authenticate with their required API key headers.

Bug Fixes:

• Preserve and explicitly send a single X-Api-Key header for Anthropic-compatible providers, including custom API key values, across SDK versions.

Tests:

• Add regression coverage for default and custom API key headers and update provider header expectations.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. Requests now include the configured API key in an X-Api-Key header, which compatible endpoints may use to authorize access. Reverting stops future requests from sending it this way, but cannot undo requests already made or recover a credential exposed to a misconfigured or unintended endpoint.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook