providers: google/anthropic list_models overrides don't trim whitespace API keys

Author: LearningCircuitCreated Sep 18, 2026Updated Sep 18, 2026

Follow-up from PR #6578.

PR #6578 fixed the paste-with-whitespace failure mode in openai_base.list_models_for_api (keys are now stripped like create_llm's resolve_api_key). Two overrides still send the raw key:

  • google.py list_models_for_api: x-goog-api-key header with the untrimmed key; a whitespace-only key is truthy → sent → guaranteed 401
  • anthropic.py (~line 193, inherited by custom_anthropic_endpoint.py): passes api_key or OPTIONAL_API_KEY_PLACEHOLDER untrimmed; same whitespace-only hazard

Result today: research works (create_llm strips) while model discovery silently fails auth — the exact asymmetry the openai_base fix closed.

Source: LearningCircuit/local-deep-research