Support a custom API-key auth header in connections

The API-key connection always presented the key as Authorization:
Bearer. Some providers, notably Anthropic, require the key in a custom
header such as x-api-key and reject Bearer auth, returning 400 when
both headers are present.

Add an optional Header field on APIKeyConnection (empty preserves the
Bearer default for every existing provider) served by a small transport
that omits Authorization, plus a registry-declared APIKeyHeader so the
create-connector resolver wires the right scheme per provider.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/registry.go

@@ -119,6 +119,19 @@ func (r *Registry) ProviderDisplayName(p coredata.ConnectorProvider) string {
 	return string(p)
 }
 
+// APIKeyHeader returns the request header an API-key connection for the
+// given provider must use to present its key. Empty means the default
+// `Authorization: Bearer` scheme; a value such as "x-api-key" means the
+// raw key is sent in that header instead. Returns empty for unknown
+// providers and for providers that do not customise the scheme.
+func (r *Registry) APIKeyHeader(p coredata.ConnectorProvider) string {
+	if reg, ok := r.Get(p); ok {
+		return reg.APIKeyHeader
+	}
+
+	return ""
+}
+
 // ProviderOAuth2Scopes returns the OAuth2 scopes the access review
 // driver for the given provider needs to list user accounts. Returns
 // nil for providers that do not need any scopes (Notion, Intercom)

pkg/connector/provider/types.go

@@ -56,6 +56,13 @@ type Registration struct {
 	SupportsAPIKey            bool
 	SupportsClientCredentials bool
 	ExtraSettings             []ExtraSetting
+	// APIKeyHeader selects how an API-key connection presents its key
+	// on outbound requests. Empty (the default) uses the standard
+	// `Authorization: Bearer <key>` scheme; a value such as "x-api-key"
+	// sends the raw key in that header instead and omits Authorization
+	// (Anthropic). It is consumed when the create-connector resolver
+	// builds the APIKeyConnection.
+	APIKeyHeader string
 
 	// Factory closures — wired by Stages 2 and 3.
 	NewDriver               func(context.Context, *http.Client, *coredata.Connector, *log.Logger) (drivers.Driver, error)