Skip to content

fix: treat empty-string ANTHROPIC_API_KEY/AUTH_TOKEN env vars as absent#1734

Open
Yadidiah-k wants to merge 1 commit into
anthropics:mainfrom
Yadidiah-k:Yadidiah-k/fix/empty-env-credential-skipped
Open

fix: treat empty-string ANTHROPIC_API_KEY/AUTH_TOKEN env vars as absent#1734
Yadidiah-k wants to merge 1 commit into
anthropics:mainfrom
Yadidiah-k:Yadidiah-k/fix/empty-env-credential-skipped

Conversation

@Yadidiah-k

Copy link
Copy Markdown

Summary

os.environ.get("ANTHROPIC_API_KEY") returns "" when the variable is exported but set to an empty string. That empty string was stored as self.api_key / self.auth_token because the existing check only guarded against None. When building headers, _bearer_auth then produced Authorization: Bearer (with a trailing space), which h11 rejects at write time with LocalProtocolError: Illegal header value b'Bearer '.

This is especially common in:

  • CI containers where vars are exported empty as defaults
  • The Claude Code CLI shell, which exports both ANTHROPIC_AUTH_TOKEN= and ANTHROPIC_API_KEY= into child processes

Fix: apply or None after os.environ.get() so empty strings are treated as absent, consistent with how every other env-var credential system works.

Both the Anthropic (sync) and AsyncAnthropic initializers had the same issue — both are fixed.

Changes

  • src/anthropic/_client.py: two-line fix in the hand-written credentials section (lines marked # hand-written, upstream to Stainless) — both sync and async clients
  • tests/test_client.py: regression tests for TestAnthropic and TestAsyncAnthropic asserting that empty-string env vars leave api_key and auth_token as None

Closes #1640

os.environ.get() returns "" when a var is exported but empty. That empty
string passed through as self.api_key / self.auth_token, causing
_bearer_auth to build "Authorization: Bearer " (trailing space), which
h11 rejects with LocalProtocolError. This is common in CI environments
and inside the Claude Code CLI shell where both vars are exported empty.

Fixes anthropics#1640
@Yadidiah-k Yadidiah-k requested a review from a team as a code owner July 5, 2026 14:37
paulpham157 pushed a commit to paulpham157/anthropic-sdk-python that referenced this pull request Jul 7, 2026
anthropics#1734)

Mirrors the us/eu region branches from the sync AnthropicVertex into
AsyncAnthropicVertex.__init__. Previously these regions fell through to
the generic fallback and built {region}-aiplatform.googleapis.com, which
returns 404 from the GCP URL router.

Adds matching unit tests on TestAsyncAnthropicVertex to mirror the
existing sync test pattern.

Picked up from anthropics#1406 (Alex Toberoff).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Anthropic() emits a malformed Authorization: Bearer header when ANTHROPIC_AUTH_TOKEN is an empty string

1 participant