diff --git a/CHANGELOG.md b/CHANGELOG.md
index e5fd1db22..d71976426 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ Only write entries that are worth mentioning to users.
 ## Unreleased
 
 - Core: Pass session ID as `user_id` metadata to Anthropic API
+- Core: Strip whitespace from OAuth header values to prevent encoding errors
 
 ## 1.17.0 (2026-03-03)
 
diff --git a/docs/en/release-notes/changelog.md b/docs/en/release-notes/changelog.md
index 9d4675d53..ca816a5e1 100644
--- a/docs/en/release-notes/changelog.md
+++ b/docs/en/release-notes/changelog.md
@@ -5,6 +5,7 @@ This page documents the changes in each Kimi Code CLI release.
 ## Unreleased
 
 - Core: Pass session ID as `user_id` metadata to Anthropic API
+- Core: Strip whitespace from OAuth header values to prevent encoding errors
 
 ## 1.17.0 (2026-03-03)
 
diff --git a/docs/zh/release-notes/changelog.md b/docs/zh/release-notes/changelog.md
index e401a91b0..8a8cd1a7a 100644
--- a/docs/zh/release-notes/changelog.md
+++ b/docs/zh/release-notes/changelog.md
@@ -5,6 +5,7 @@
 ## 未发布
 
 - Core：将会话 ID 作为 `user_id` 元数据传递给 Anthropic API
+- Core：对 OAuth 头字段值去除首尾空白，避免编码错误
 
 ## 1.17.0 (2026-03-03)
 
diff --git a/src/kimi_cli/auth/oauth.py b/src/kimi_cli/auth/oauth.py
index 96d025d96..2c7a0184a 100644
--- a/src/kimi_cli/auth/oauth.py
+++ b/src/kimi_cli/auth/oauth.py
@@ -193,9 +193,10 @@ def get_device_id() -> str:
 
 
 def _ascii_header_value(value: str, *, fallback: str = "unknown") -> str:
+    value = value.strip()
     try:
         value.encode("ascii")
-        return value
+        return value or fallback
     except UnicodeEncodeError:
         sanitized = value.encode("ascii", errors="ignore").decode("ascii").strip()
         return sanitized or fallback
diff --git a/tests/utils/test_utils_environment.py b/tests/utils/test_utils_environment.py
index abb3a4ae4..807bdafab 100644
--- a/tests/utils/test_utils_environment.py
+++ b/tests/utils/test_utils_environment.py
@@ -3,6 +3,8 @@
 import pytest
 from kaos.path import KaosPath
 
+from kimi_cli.auth.oauth import _ascii_header_value, _common_headers
+
 
 @pytest.mark.skipif(platform.system() == "Windows", reason="Skipping test on Windows")
 async def test_environment_detection(monkeypatch):
@@ -39,3 +41,28 @@ async def test_environment_detection_windows(monkeypatch):
     assert env.os_version == "10.0.19044"
     assert env.shell_name == "Windows PowerShell"
     assert str(env.shell_path) == "powershell.exe"
+
+
+def test_ascii_header_value_strips_ascii_whitespace():
+    assert _ascii_header_value("  value  ") == "value"
+    assert _ascii_header_value("   ") == "unknown"
+
+
+def test_common_headers_strip_os_version(monkeypatch):
+    monkeypatch.setattr(platform, "node", lambda: "host")
+    monkeypatch.setattr(platform, "system", lambda: "Linux")
+    monkeypatch.setattr(platform, "machine", lambda: "x86_64")
+    monkeypatch.setattr(platform, "release", lambda: "6.8.0-101-generic")
+    monkeypatch.setattr(
+        platform,
+        "version",
+        lambda: "#101~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb 11 13:19:54 UTC ",
+    )
+    monkeypatch.setattr("kimi_cli.auth.oauth.get_device_id", lambda: "device-id")
+
+    headers = _common_headers()
+
+    assert (
+        headers["X-Msh-Os-Version"]
+        == "#101~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb 11 13:19:54 UTC"
+    )