Client-to-backend auth
All managed-agents requests to Synth backend require:Authorization: Bearer <SYNTH_API_KEY>
Compatibility headers
Synth managed-agents Anthropic-compatible routes use:anthropic-version(required)anthropic-beta(required for beta-only managed-agents features)
managed-agents-2026-04-01
Backend-to-upstream auth policy
The backend proxy uses service-token mode upstream:HORIZONS_PRIVATE_SERVICE_API_KEYis required on backend service- upstream auth is handled server-side by backend proxy
- client bearer token is still validated at backend edge for org access
Header forwarding policy
Managed-agents proxy behavior is intentionally strict:- forwards compatibility headers (
anthropic-version,anthropic-beta) - forwards request body/query as-is for supported endpoints
- drops non-allowlisted compatibility headers
Common errors
| Symptom | Likely cause |
|---|---|
401/403 at backend edge | Missing or invalid SYNTH_API_KEY |
5xx config-style proxy error | Missing backend HORIZONS_PRIVATE_BASE_URL or HORIZONS_PRIVATE_SERVICE_API_KEY |
| Upstream rejects request version/beta | Invalid or unsupported anthropic-version / anthropic-beta |