Why does my Next.js API route return 401 even though I'm sending the Authorization header correctly?

I have a Next.js 14 app router API route protected by JWT. The token is generated correctly on login, stored in localStorage, and attached to every request via an Authorization: Bearer <token> header.

But the API route keeps returning 401 Unauthorized even when I log the incoming headers — the authorization header is undefined.

Here is my fetch call:

const res = await fetch('/api/protected', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
});

And here is my route handler:

export async function GET(request: Request) {
  const auth = request.headers.get('authorization');
  console.log('auth header:', auth); // logs: null
  if (!auth) return new Response('Unauthorized', { status: 401 });
  // ...
}

I have verified the token exists in localStorage before the fetch runs. What am I missing?

• Next.js 14.2
• Node 20
• Using App Router (not Pages Router)