diff --git a/.changeset/itchy-dingos-beg.md b/.changeset/itchy-dingos-beg.md
new file mode 100644
index 00000000000..5af263deff7
--- /dev/null
+++ b/.changeset/itchy-dingos-beg.md
@@ -0,0 +1,5 @@
+---
+"@effect/platform": patch
+---
+
+ensure key for header security is lower case
diff --git a/packages/platform/src/HttpApiBuilder.ts b/packages/platform/src/HttpApiBuilder.ts
index 2d8dd0b44a2..04861f3d41d 100644
--- a/packages/platform/src/HttpApiBuilder.ts
+++ b/packages/platform/src/HttpApiBuilder.ts
@@ -971,8 +971,9 @@ export const securityDecode = <Security extends HttpApiSecurity.HttpApiSecurity>
       )
     }
     case "ApiKey": {
+      const key = self.in === "header" ? self.key.toLowerCase() : self.key
       const schema = Schema.Struct({
-        [self.key]: Schema.String
+        [key]: Schema.String
       })
       const decode = unify(
         self.in === "query"
@@ -983,7 +984,7 @@ export const securityDecode = <Security extends HttpApiSecurity.HttpApiSecurity>
       )
       return Effect.match(decode, {
         onFailure: () => Redacted.make("") as any,
-        onSuccess: (match) => Redacted.make(match[self.key])
+        onSuccess: (match) => Redacted.make(match[key])
       })
     }
     case "Basic": {