[KVR Vishnu (VISHNU0906)]

What

The server auth dependency treated the Authorization scheme as case-sensitive (startswith("Bearer ")), so a correct key sent as bearer …, BEARER …, or BeArEr … got a 401. RFC 7235 §2.1 makes the auth-scheme case-insensitive and allows one or more spaces before the credentials.

This change splits the header into scheme and token, compares the scheme with casefold() against bearer, and keeps an exact match on the key. The existing x-api-key path is unchanged.

Why

Clients and gateways that normalize the scheme to lowercase (or otherwise change casing) could not authenticate even with a valid key. Reported by Chen Yufeiyang (@feiiiiii5) in #671.

Fixes #671

Verification

uv sync --frozen --no-default-groups --extra dev --group dev
uv run --locked --no-sync pre-commit run --all-files --show-diff-on-failure
uv run --locked --no-sync ruff check .
uv run --locked --no-sync ruff format --check .
uv run --locked --no-sync python scripts/check_headers.py
uv sync --frozen --no-default-groups --extra dev --group dev --group verl-cpu
uv run --locked --no-sync pyright
uv run --locked --no-sync pytest -v --durations=20 tests

Results locally: pre-commit / ruff / headers / pyright clean; full suite 255 passed, 4 skipped.

Regression coverage through the real TestClient auth path for Bearer / bearer / BEARER / BeArEr / extra spaces, plus wrong key, missing header, wrong scheme, and x-api-key. Reverting the casefold match makes the mixed/lowercase cases fail again.

I used AI assistance for parts of this change and tested it locally against the full test suite.

[Copilot]

🟢 Approval recommended

There are no active review issues for the change enabling case-insensitive Bearer authentication while preserving exact API-key matching.

No open issues 🎉

What changed in this PR

Fixes #671 by allowing case-insensitive Bearer authentication schemes in the server while preserving exact API-key matching and existing x-api-key support.

Changes:

• Splits the Authorization header into scheme and token, accepting mixed-case schemes and extra separator spaces.
• Adds endpoint regression tests for valid Bearer variants, invalid credentials, and x-api-key authentication.

File	Description
tests/​server/​test_endpoints.py	Adds authentication acceptance and rejection tests through the real endpoint dependency.
agentlightning/​server/​app.py	Parses Bearer credentials and compares the scheme case-insensitively.

_{Review effort: Balanced}