Skip to content

Expose custom API auth header options in workflow frontmatter (authHeader) #35693

Description

@lpcox

Context

gh-aw-firewall PR #3998 (merged) added support for custom API auth header names via:

  • CLI flags: --openai-api-auth-header <name>, --anthropic-api-auth-header <name>
  • Env vars: AWF_OPENAI_AUTH_HEADER, AWF_ANTHROPIC_AUTH_HEADER
  • Config file: apiProxy.targets.openai.authHeader, apiProxy.targets.anthropic.authHeader

This lets internal AI gateways (e.g. Azure OpenAI with api-key: header) work without the standard Authorization: Bearer or x-api-key patterns.

Request

Expose these new config options through gh-aw workflow frontmatter so users can configure custom auth headers declaratively:

# Proposed frontmatter syntax
awf:
  apiProxy:
    targets:
      openai:
        host: azure-openai.internal
        authHeader: api-key
      anthropic:
        host: anthropic-gw.internal
        authHeader: api-key

AWF Schema & Spec References

The following files in gh-aw-firewall define the new options:

  • JSON Schema: src/awf-config-schema.jsonproviderTarget $def now includes authHeader (string)
  • Config spec: docs/awf-config-spec.md — documents the mapping:
    • apiProxy.targets.openai.authHeader--openai-api-auth-header
    • apiProxy.targets.anthropic.authHeader--anthropic-api-auth-header
  • TypeScript types: src/types/api-proxy-options.tsopenaiApiAuthHeader?: string, anthropicApiAuthHeader?: string

Behavior Notes

  • OpenAI: When authHeader is set, the raw API key is sent as <headerName>: <key> (no Bearer prefix). This matches Azure OpenAI's api-key: <rawkey> convention.
  • Anthropic: When authHeader is set, it replaces the default x-api-key header name. OIDC mode always uses Authorization: Bearer regardless of this setting.
  • Not security-sensitive: The authHeader value is just a header name (e.g. api-key), not a secret — safe to include in config files and frontmatter.

Acceptance Criteria

  • gh-aw compiler maps awf.apiProxy.targets.{openai,anthropic}.authHeader from frontmatter to AWF config
  • Validation rejects non-string values
  • Documentation updated

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions