diff --git a/app/api/workflow/middleware.ts b/app/api/workflow/middleware.ts
index 63c607528b..d744f5bddd 100644
--- a/app/api/workflow/middleware.ts
+++ b/app/api/workflow/middleware.ts
@@ -33,8 +33,14 @@ export async function validateWorkflowAccess(
       }
 
       // API key authentication
-      const apiKey =
-        request.headers.get('x-api-key') || request.nextUrl.searchParams.get('X-API-KEY')
+      let apiKey = null
+      for (const [key, value] of request.headers.entries()) {
+        if (key.toLowerCase() === 'x-api-key' && value) {
+          apiKey = value
+          break
+        }
+      }
+
       if (!apiKey || !workflow.apiKey || apiKey !== workflow.apiKey) {
         return {
           error: {