New API endpoints with [variable] syntax in headers generate literal text instead of string interpolation

[LuBas273]

Can we access your project?

• I give permission for members of the FlutterFlow team to access and test my project for the sole purpose of investigating this issue.

Current Behavior

When creating a new API endpoint with a header value like "Bearer [authToken]" (referencing a call-level Variable), the generated Dart code produces the literal text "Bearer " instead of interpolating the real variable value. This causes every call using that header to fail with HTTP 401 "Session expired" from our backend, since the literal placeholder text is sent instead of a real token.

Expected Behavior

The header should interpolate to "Bearer ${authToken}" (the real variable's value at runtime), exactly like it already does on other endpoints in the same project (e.g. apimyjobs, apiclockin) that use the identical "Bearer [authToken]" syntax and work correctly.

Steps to Reproduce

1. Create a new API Call (Backend Query > API Call).
2. Add a call-level Variable named authToken, type String.
3. Add a header: Authorization: Bearer [authToken]
4. Save the API Call, then use it from a page/action with a real authToken value passed in.
5. Run the app in Test Mode and trigger the call.
6. Observe the actual outgoing request sends the literal string "Bearer " instead of the real token value, and the server returns 401.

Compare against an existing endpoint in the same project (apimyjobs) that uses the identical "Authorization: Bearer [authToken]" header syntax and correctly interpolates to the real token — confirming this isn't a mistake in how the header was written, since both use the same syntax.

Reproducible from Blank

• The steps to reproduce above start from a blank project.

Bug Report Code (Required)

→ "Get Bug Report Code" →

Visual documentation

Environment

- FlutterFlow version: [check your account/project settings for this — I don't have it]
- Platform: Web
- Browser name and version: [check via chrome://version if using Chrome]
- Operating system and version: Windows 11 Home 10.0.26200

Additional Information

This is blocking a technician field-service app — three of the four remaining major pages (Compliance, Inductions, Leave records) cannot be wired to our backend API until this is fixed, since every new endpoint we create hits this same auth failure.