Allow custom headers for BYOK

[ZzetT]

Describe the feature or problem you'd like to solve

Some LLM servers require specific headers to be sent, allow to set custom http(s) headers
Examples could be:

• X-Tenant-ID / X-Organization-ID: Identifies which company or sub-organization is making the request to ensure their specific data boundaries and rate limits are respected.
• X-User-ID: Tracks usage down to the individual employee or end-user, often used to prevent a single user from exhausting the company's API quota.
• X-Fallback-Models: Instructs the gateway on what to do if the primary model is down
• X-Cache-Bypass: Forces the server to ignore the cache and generate a fresh response from the LLM. Useful for testing or if the LLM is expected to return real-time data.
• anthropic-beta: Anthropic frequently uses this to enable experimental features

Proposed solution

Add COPILOT_EXTRA_HEADERS (or COPILOT_CUSTOM_HEADERS) to set one ore multiple headers in the format "Name: Value" (newline for multiple headers)

Filter out headers Authorization or x-api-key (or do not allow them)

Example prompts or workflows

export COPILOT_EXTRA_HEADERS="X-Tenant-ID: 1234\nX-Proxy-Bypass: true"

Additional context

No response

[mukeshgurpude]

Is this being worked on?

[brenwhyte]

Strong +1 on this from an enterprise perspective — specifically the anthropic-beta example mentioned in the description is exactly our blocker.

Our use case: We run a self-hosted Portkey AI gateway in front of AWS Bedrock, AzureAI and Vertex AI used by hundreds of developers across multiple teams. The gateway handles auth, EU data residency, cost attribution, and observability via custom headers. BYOK is almost perfect for routing Copilot CLI through this infrastructure, but two headers are currently unsendable:

• anthropic-beta: context-1m-2025-08-07,interleaved-thinking-2025-05-14 — without this, Claude Sonnet 4.6 and Opus 4.8 are capped at 200K tokens through our gateway even though the models support 1M. This is the header Anthropic uses to unlock extended context on Bedrock. Without it, developers using Copilot CLI BYOK get a worse context experience than developers using OpenCode with our gateway config, which can send headers freely.
• x-portkey-api-key — our gateway resolves provider credentials and routing from this header. Without it, requests fall back to less specific virtual key resolution.

The proposed COPILOT_EXTRA_HEADERS env var (in the Name: Value\n format) would solve both completely. The security consideration of filtering out Authorization and x-api-key makes sense — those are already handled by COPILOT_PROVIDER_API_KEY.

As an alternative shape: a COPILOT_EXTRA_HEADERS that accepts a JSON object might be slightly easier to parse for multi-value headers, though the newline format is simpler to set in shell profiles:

# Newline format (as proposed)
export COPILOT_EXTRA_HEADERS="anthropic-beta: context-1m-2025-08-07,interleaved-thinking-2025-05-14\nx-portkey-api-key: my-key"

# JSON alternative
export COPILOT_EXTRA_HEADERS='{"anthropic-beta":"context-1m-2025-08-07","x-portkey-api-key":"my-key"}'

Either works for our use case. The newline format is probably more shell-friendly for most users. Happy to test any beta implementation against our setup if that would help validate the feature.

[cf-rdegregory]

I strongly agree with @brenwhyte, this is pretty essential for enterprises running their own AI Gateways...including Microsoft's own AI Gateway Azure API Management (APIM).

I've already submitted this same issue in the VS Code repository: microsoft/vscode#317810.

They knocked it out within a day...shouldn't be too hard to do the same here, right? 😄

[copilot-cli-bot]

This appears to be resolved as of GitHub Copilot CLI v1.0.86. Please update to that release or a newer stable version. We're closing this as completed. If it still happens, please comment with your version and reproduction steps.

[ZzetT]

Dear almighty @copilot-cli-bot

While I admire your boundless optimism and talent for hallucinating features into existence, v1.0.86 did not actually implement custom HTTP headers for BYOK.
For reference, the actual release notes for v1.0.86:

Custom agents can opt into repository instruction files (AGENTS.md, copilot-instructions.md, CLAUDE.md) by setting include-custom-instructions: true in their frontmatter.
Resuming an active session without plugin-directory, discovery, or working-directory overrides preserves marketplace plugins and skills after reload. Configuration read or validation failures no longer discard active plugins; missing-file and intentional-removal behavior is unchanged.
/sandbox policy now reports local-network access using your configured setting
The status row now says it is waiting for background shells, instead of "Working", when a turn ends while an attached background shell such as a dev server is still running.
Resume sessions even when transcript files contain recoverable corruption
Expanded reasoning text in the compact timeline is no longer dimmed, so it is as readable as the rest of the timeline.
Autopilot stops after accepted task completion instead of continuing unexpectedly

None of these allow sending custom headers like COPILOT_EXTRA_HEADERS (or anthropic-beta and gateway routing keys) to LLM endpoints. There is no linked PR, no commits addressing this, and the feature definitely hasn't materialized out of thin air.

Could a human maintainer please reopen this issue?

[cf-rdegregory]

Dear almighty @copilot-cli-bot

While I admire your boundless optimism and talent for hallucinating features into existence, v1.0.86 did not actually implement custom HTTP headers for BYOK. For reference, the actual release notes for v1.0.86:

Custom agents can opt into repository instruction files (AGENTS.md, copilot-instructions.md, CLAUDE.md) by setting include-custom-instructions: true in their frontmatter.
Resuming an active session without plugin-directory, discovery, or working-directory overrides preserves marketplace plugins and skills after reload. Configuration read or validation failures no longer discard active plugins; missing-file and intentional-removal behavior is unchanged.
/sandbox policy now reports local-network access using your configured setting
The status row now says it is waiting for background shells, instead of "Working", when a turn ends while an attached background shell such as a dev server is still running.
Resume sessions even when transcript files contain recoverable corruption
Expanded reasoning text in the compact timeline is no longer dimmed, so it is as readable as the rest of the timeline.
Autopilot stops after accepted task completion instead of continuing unexpectedly

None of these allow sending custom headers like COPILOT_EXTRA_HEADERS (or anthropic-beta and gateway routing keys) to LLM endpoints. There is no linked PR, no commits addressing this, and the feature definitely hasn't materialized out of thin air.

Could a human maintainer please reopen this issue?

@stephentoub can you please bonk the bot?