diff --git a/fab_auth.py b/fab_auth.py
index 384d3c1..8b630f4 100644
--- a/fab_auth.py
+++ b/fab_auth.py
@@ -184,6 +184,14 @@ class ReplayCache:
         return True
 
 
+def _hdr(headers: dict[str, str], name: str) -> str:
+    want = name.lower()
+    for key, value in headers.items():
+        if key.lower() == want:
+            return (value or "").strip()
+    return ""
+
+
 def verify_request(
     headers: dict[str, str],
     http_method: str,
@@ -191,14 +199,14 @@ def verify_request(
     raw_body: bytes,
     replay: ReplayCache,
 ) -> dict[str, Any]:
-    auth = headers.get("Authorization") or headers.get("authorization") or ""
-    match = re.fullmatch(r"FAB-ED25519 id=([0-9a-f]{32})", auth.strip())
+    auth = _hdr(headers, "Authorization")
+    match = re.fullmatch(r"FAB-ED25519 id=([0-9a-f]{32})", auth)
     if not match:
         raise PermissionError("signed FAB-ED25519 client required")
     client_id = match.group(1)
-    timestamp = (headers.get("X-FAB-Timestamp") or headers.get("x-fab-timestamp") or "").strip()
-    nonce = (headers.get("X-FAB-Nonce") or headers.get("x-fab-nonce") or "").strip()
-    signature = (headers.get("X-FAB-Signature") or headers.get("x-fab-signature") or "").strip()
+    timestamp = _hdr(headers, "X-FAB-Timestamp")
+    nonce = _hdr(headers, "X-FAB-Nonce")
+    signature = _hdr(headers, "X-FAB-Signature")
     if not timestamp.isdigit() or not nonce or not signature:
         raise PermissionError("missing signature headers")
     now = time.time()