fix auth flow for RWPX keys

internal/handler/anthropic.go

@@ -19,30 +19,27 @@ import (
 
 // HandleMessages handles Anthropic Messages API requests (/v1/messages)
 func HandleMessages(w http.ResponseWriter, r *http.Request) {
-	// Extract token from x-api-key or Authorization header
-	token := r.Header.Get("x-api-key")
-	if token == "" {
-		token = strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-	}
-	if token == "" {
-		writeAnthropicError(w, http.StatusUnauthorized, "authentication_error", "Missing API key")
-		return
-	}
-	ok, reason := CheckAndTrack(token, 0)
-	if !ok {
-		writeAnthropicError(w, http.StatusTooManyRequests, "rate_limit_error", reason)
-		return
-	}
-	if token == "free" || strings.HasPrefix(token, "RWPX-") {
-		anonymousToken, err := auth.GetAnonymousToken()
-		if err != nil {
-			logger.LogError("Failed to get anonymous token: %v", err)
-			writeAnthropicError(w, http.StatusInternalServerError, "api_error", "Failed to get anonymous token")
-			return
-		}
-		token = anonymousToken
-	}
-
+apiKey := r.Header.Get("x-api-key")
+if apiKey == "" { apiKey = strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ") }
+if apiKey == "" {
+writeAnthropicError(w, http.StatusUnauthorized, "authentication_error", "Missing API key")
+return
+}
+ok, reason := CheckAndTrack(apiKey, 0)
+if !ok {
+writeAnthropicError(w, http.StatusTooManyRequests, "rate_limit_error", reason)
+return
+}
+token := apiKey
+if token == "free" || strings.HasPrefix(token, "RWPX-") {
+anonymousToken, err := auth.GetAnonymousToken()
+if err != nil {
+logger.LogError("Failed to get anonymous token: %v", err)
+writeAnthropicError(w, http.StatusInternalServerError, "api_error", "Failed to get anonymous token")
+return
+}
+token = anonymousToken
+}
 	var req model.AnthropicRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeAnthropicError(w, http.StatusBadRequest, "invalid_request_error", "Invalid request body")

internal/handler/chat.go

@@ -19,22 +19,27 @@ import (
 )
 
 func HandleChatCompletions(w http.ResponseWriter, r *http.Request) {
-	token := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-	if token == "" {
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
-		return
-	}
-
-	if token == "free" {
-		anonymousToken, err := auth.GetAnonymousToken()
-		if err != nil {
-			logger.LogError("Failed to get anonymous token: %v", err)
-			http.Error(w, "Failed to get anonymous token", http.StatusInternalServerError)
-			return
-		}
-		token = anonymousToken
-	}
-
+apiKey := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+if apiKey == "" { apiKey = r.Header.Get("x-api-key") }
+if apiKey == "" {
+http.Error(w, "Unauthorized", http.StatusUnauthorized)
+return
+}
+ok, reason := CheckAndTrack(apiKey, 0)
+if !ok {
+http.Error(w, reason, http.StatusTooManyRequests)
+return
+}
+token := apiKey
+if token == "free" || strings.HasPrefix(token, "RWPX-") {
+anonymousToken, err := auth.GetAnonymousToken()
+if err != nil {
+logger.LogError("Failed to get anonymous token: %v", err)
+http.Error(w, "Failed to get anonymous token", http.StatusInternalServerError)
+return
+}
+token = anonymousToken
+}
 	var req model.ChatRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "Invalid request", http.StatusBadRequest)