simonw · ricyoung · Jan 12, 2026
diff --git a/._.git b/._.git
diff --git a/._.github b/._.github
diff --git a/._.gitignore b/._.gitignore
diff --git a/._.readthedocs.yaml b/._.readthedocs.yaml
diff --git a/._.venv b/._.venv
diff --git a/._AGENTS.md b/._AGENTS.md
diff --git a/._Justfile b/._Justfile
diff --git a/._LICENSE b/._LICENSE
diff --git a/._MANIFEST.in b/._MANIFEST.in
diff --git a/._README.md b/._README.md
diff --git a/._docs b/._docs
diff --git a/._llm b/._llm
diff --git a/._mypy.ini b/._mypy.ini
diff --git a/._pyproject.toml b/._pyproject.toml
diff --git a/._pytest.ini b/._pytest.ini
diff --git a/._ruff.toml b/._ruff.toml
diff --git a/._tests b/._tests
diff --git a/.github/._FUNDING.yml b/.github/._FUNDING.yml
diff --git a/.github/._dependabot.yml b/.github/._dependabot.yml
diff --git a/.github/._workflows b/.github/._workflows
diff --git a/.github/workflows/._cog.yml b/.github/workflows/._cog.yml
diff --git a/.github/workflows/._publish.yml b/.github/workflows/._publish.yml
diff --git a/.github/workflows/._stable-docs.yml b/.github/workflows/._stable-docs.yml
diff --git a/.github/workflows/._test.yml b/.github/workflows/._test.yml
diff --git a/docs/._.gitignore b/docs/._.gitignore
diff --git a/docs/._Makefile b/docs/._Makefile
diff --git a/docs/.__templates b/docs/.__templates
diff --git a/docs/._aliases.md b/docs/._aliases.md
diff --git a/docs/._changelog.md b/docs/._changelog.md
diff --git a/docs/._conf.py b/docs/._conf.py
diff --git a/docs/._contributing.md b/docs/._contributing.md
diff --git a/docs/._embeddings b/docs/._embeddings
diff --git a/docs/._fragments.md b/docs/._fragments.md
diff --git a/docs/._help.md b/docs/._help.md
diff --git a/docs/._index.md b/docs/._index.md
diff --git a/docs/._logging.md b/docs/._logging.md
diff --git a/docs/._openai-models.md b/docs/._openai-models.md
diff --git a/docs/._other-models.md b/docs/._other-models.md
diff --git a/docs/._plugins b/docs/._plugins
diff --git a/docs/._python-api.md b/docs/._python-api.md
diff --git a/docs/._related-tools.md b/docs/._related-tools.md
diff --git a/docs/._requirements.txt b/docs/._requirements.txt
diff --git a/docs/._schemas.md b/docs/._schemas.md
diff --git a/docs/._setup.md b/docs/._setup.md
diff --git a/docs/._templates.md b/docs/._templates.md
diff --git a/docs/._tools.md b/docs/._tools.md
diff --git a/docs/._usage.md b/docs/._usage.md
diff --git a/docs/_templates/._base.html b/docs/_templates/._base.html
diff --git a/docs/embeddings/._cli.md b/docs/embeddings/._cli.md
diff --git a/docs/embeddings/._index.md b/docs/embeddings/._index.md
diff --git a/docs/embeddings/._python-api.md b/docs/embeddings/._python-api.md
diff --git a/docs/embeddings/._storage.md b/docs/embeddings/._storage.md
diff --git a/docs/embeddings/._writing-plugins.md b/docs/embeddings/._writing-plugins.md
diff --git a/docs/plugins/._advanced-model-plugins.md b/docs/plugins/._advanced-model-plugins.md
diff --git a/docs/plugins/._directory.md b/docs/plugins/._directory.md
diff --git a/docs/plugins/._index.md b/docs/plugins/._index.md
diff --git a/docs/plugins/._installing-plugins.md b/docs/plugins/._installing-plugins.md
diff --git a/docs/plugins/._llm-markov b/docs/plugins/._llm-markov
diff --git a/docs/plugins/._plugin-hooks.md b/docs/plugins/._plugin-hooks.md
diff --git a/docs/plugins/._plugin-utilities.md b/docs/plugins/._plugin-utilities.md
diff --git a/docs/plugins/._tutorial-model-plugin.md b/docs/plugins/._tutorial-model-plugin.md
diff --git a/docs/plugins/llm-markov/._llm_markov.py b/docs/plugins/llm-markov/._llm_markov.py
diff --git a/docs/plugins/llm-markov/._pyproject.toml b/docs/plugins/llm-markov/._pyproject.toml
diff --git a/llm/.___init__.py b/llm/.___init__.py
diff --git a/llm/.___main__.py b/llm/.___main__.py
diff --git a/llm/._cli.py b/llm/._cli.py
diff --git a/llm/._default_plugins b/llm/._default_plugins
diff --git a/llm/._embeddings.py b/llm/._embeddings.py
diff --git a/llm/._embeddings_migrations.py b/llm/._embeddings_migrations.py
diff --git a/llm/._errors.py b/llm/._errors.py
diff --git a/llm/._hookspecs.py b/llm/._hookspecs.py
diff --git a/llm/._migrations.py b/llm/._migrations.py
diff --git a/llm/._models.py b/llm/._models.py
diff --git a/llm/._plugins.py b/llm/._plugins.py
diff --git a/llm/._py.typed b/llm/._py.typed
diff --git a/llm/._templates.py b/llm/._templates.py
diff --git a/llm/._tools.py b/llm/._tools.py
diff --git a/llm/._utils.py b/llm/._utils.py
diff --git a/llm/default_plugins/.___init__.py b/llm/default_plugins/.___init__.py
diff --git a/llm/default_plugins/._default_tools.py b/llm/default_plugins/._default_tools.py
diff --git a/llm/default_plugins/._openai_models.py b/llm/default_plugins/._openai_models.py
diff --git a/llm/default_plugins/openai_models.py b/llm/default_plugins/openai_models.py
@@ -680,6 +680,12 @@ def set_usage(self, response, usage):
             input=input_tokens, output=output_tokens, details=simplify_usage_dict(usage)
         )
 
+    def _headers_include_auth(self):
+        """Check if custom headers include an authorization header (case-insensitive)."""
+        if not self.headers:
+            return False
+        return any(key.lower() == "authorization" for key in self.headers)
+
     def get_client(self, key, *, async_=False):
         kwargs = {}
         if self.api_base:
@@ -692,9 +698,10 @@ def get_client(self, key, *, async_=False):
             kwargs["engine"] = self.api_engine
         if self.needs_key:
             kwargs["api_key"] = self.get_key(key)
-        else:
+        elif not self._headers_include_auth():
             # OpenAI-compatible models don't need a key, but the
-            # openai client library requires one
+            # openai client library requires one - unless custom
+            # headers already provide authorization
             kwargs["api_key"] = "DUMMY_KEY"
         if self.headers:
             kwargs["default_headers"] = self.headers

diff --git a/tests/._cassettes b/tests/._cassettes
diff --git a/tests/._conftest.py b/tests/._conftest.py
diff --git a/tests/._test-llm-load-plugins.sh b/tests/._test-llm-load-plugins.sh
diff --git a/tests/._test_aliases.py b/tests/._test_aliases.py
diff --git a/tests/._test_async.py b/tests/._test_async.py
diff --git a/tests/._test_attachments.py b/tests/._test_attachments.py
diff --git a/tests/._test_chat.py b/tests/._test_chat.py
diff --git a/tests/._test_chat_templates.py b/tests/._test_chat_templates.py
diff --git a/tests/._test_cli_openai_models.py b/tests/._test_cli_openai_models.py
diff --git a/tests/._test_cli_options.py b/tests/._test_cli_options.py
diff --git a/tests/._test_embed.py b/tests/._test_embed.py
diff --git a/tests/._test_embed_cli.py b/tests/._test_embed_cli.py
diff --git a/tests/._test_encode_decode.py b/tests/._test_encode_decode.py
diff --git a/tests/._test_fragments_cli.py b/tests/._test_fragments_cli.py
diff --git a/tests/._test_keys.py b/tests/._test_keys.py
diff --git a/tests/._test_llm.py b/tests/._test_llm.py
diff --git a/tests/._test_llm_logs.py b/tests/._test_llm_logs.py
diff --git a/tests/._test_migrate.py b/tests/._test_migrate.py
diff --git a/tests/._test_plugins.py b/tests/._test_plugins.py
diff --git a/tests/._test_templates.py b/tests/._test_templates.py
diff --git a/tests/._test_tools.py b/tests/._test_tools.py
diff --git a/tests/._test_tools_streaming.py b/tests/._test_tools_streaming.py
diff --git a/tests/._test_utils.py b/tests/._test_utils.py
diff --git a/tests/cassettes/._test_tools b/tests/cassettes/._test_tools
diff --git a/tests/cassettes/._test_tools_streaming b/tests/cassettes/._test_tools_streaming
diff --git a/tests/cassettes/test_tools/._test_tool_use_basic.yaml b/tests/cassettes/test_tools/._test_tool_use_basic.yaml
diff --git a/tests/cassettes/test_tools/._test_tool_use_chain_of_two_calls.yaml b/tests/cassettes/test_tools/._test_tool_use_chain_of_two_calls.yaml
diff --git a/tests/cassettes/test_tools_streaming/._test_tools_streaming_variant_a.yaml b/tests/cassettes/test_tools_streaming/._test_tools_streaming_variant_a.yaml
diff --git a/tests/cassettes/test_tools_streaming/._test_tools_streaming_variant_b.yaml b/tests/cassettes/test_tools_streaming/._test_tools_streaming_variant_b.yaml
diff --git a/tests/cassettes/test_tools_streaming/._test_tools_streaming_variant_c.yaml b/tests/cassettes/test_tools_streaming/._test_tools_streaming_variant_c.yaml
diff --git a/tests/test_llm.py b/tests/test_llm.py
@@ -431,6 +431,44 @@ def test_openai_localai_configuration(mocked_localai, user_path):
     }
 
 
+EXTRA_MODELS_YAML_WITH_AUTH = """
+- model_id: custom-auth-model
+  model_name: my-model
+  api_base: "http://custom-auth.localhost"
+  headers:
+    authorization: "Basic dXNlcjpwYXNzd29yZA=="
+"""
+
+
+def test_openai_custom_auth_headers(httpx_mock, user_path):
+    """Test that custom authorization headers are used instead of DUMMY_KEY."""
+    httpx_mock.add_response(
+        method="POST",
+        url="http://custom-auth.localhost/chat/completions",
+        json={
+            "model": "my-model",
+            "usage": {"prompt_tokens": 1, "completion_tokens": 2, "total_tokens": 3},
+            "choices": [{"message": {"content": "Authenticated response"}}],
+        },
+        headers={"Content-Type": "application/json"},
+    )
+    # Write the configuration file with custom auth header
+    config_path = user_path / "extra-openai-models.yaml"
+    config_path.write_text(EXTRA_MODELS_YAML_WITH_AUTH, "utf-8")
+    # Run the prompt
+    runner = CliRunner()
+    result = runner.invoke(
+        cli, ["--no-stream", "--model", "custom-auth-model", "test prompt"]
+    )
+    assert result.exit_code == 0
+    assert result.output == "Authenticated response\n"
+    # Check that the custom authorization header was sent, not DUMMY_KEY
+    last_request = httpx_mock.get_requests()[-1]
+    auth_header = last_request.headers.get("authorization")
+    assert auth_header == "Basic dXNlcjpwYXNzd29yZA=="
+    assert "Bearer DUMMY_KEY" not in str(last_request.headers)
+
+
 @pytest.mark.parametrize(
     "args,exit_code",
     (