OpenBB-finance/OpenBB · error · ValueError

Invalid authentication scheme.

Error message

Invalid authentication scheme.

What it means

Raised during MCP bearer authentication when the Authorization header's scheme is not 'Bearer' (e.g. 'Basic ...' or 'Token ...'). The server splits the header and rejects any scheme whose lowercase form is not 'bearer'. The ValueError is caught and re-raised as HTTP 401 with the same detail, so the client sees an authentication failure.

Source

Thrown at openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py:51

        self.token_url = f"{base_url}/mcp/token"

    async def authorize(self, request: Request) -> bool:
        """Authorize the request."""
        if not self.server_auth:
            return True

        auth_header = request.headers.get("Authorization")
        if not auth_header:
            raise HTTPException(
                status_code=401,
                detail="Not authenticated",
                headers={"WWW-Authenticate": "Bearer"},
            )

        try:
            scheme, token = auth_header.split()
            if scheme.lower() != "bearer":
                raise ValueError("Invalid authentication scheme.")

            try:
                decoded = base64.b64decode(token).decode("utf-8")
                username, password = decoded.split(":", 1)
            except (binascii.Error, ValueError) as e:
                raise ValueError("Invalid base64-encoded token.") from e

            expected_username, expected_password = self.server_auth

            is_user_valid = secrets.compare_digest(username, expected_username)
            is_pass_valid = secrets.compare_digest(password, expected_password)

            if not (is_user_valid and is_pass_valid):
                raise ValueError("Invalid username or password.")

            request.state.user = {"username": username}
        except (ValueError, HTTPException) as e:
            detail = getattr(e, "detail", str(e))

View on GitHub (pinned to 3e071fcc2c)

Solutions

1. Use exactly 'Authorization: Bearer <credentials>' with the literal scheme 'Bearer'.
2. Update the client's auth type to bearer-only for this server.
3. Check any intermediary that may rewrite the Authorization header.

Example fix

# before
curl -H "Authorization: Basic dXNlcjpwYXNz" http://localhost:8000/mcp

# after
curl -H "Authorization: Bearer dXNlcjpwYXNz" http://localhost:8000/mcp  # scheme must be Bearer

def bearer_header(auth_header: str) -> str:
    scheme = auth_header.split(None, 1)[0] if auth_header else ""
    if scheme.lower() != "bearer":
        raise ValueError(f"scheme must be Bearer, got {scheme!r}")
    return auth_header

def is_bearer(auth_header: str | None) -> bool:
    return bool(auth_header) and auth_header.split(None, 1)[0].lower() == "bearer"

try:
    await client.call_tool("list_categories", {})
except Exception as e:
    detail = getattr(e, "detail", str(e))
    if "Invalid authentication scheme" in str(detail):
        session.headers["Authorization"] = f"Bearer {token}"  # fix scheme, retry once
        await client.call_tool("list_categories", {})
    else:
        raise

When it happens

Trigger: Sending 'Authorization: Basic <base64>' or 'Authorization: Token abc' to the MCP endpoint; clients defaulting to a different scheme; hand-rolled headers using 'bearer' variants that don't survive splitting (e.g. multiple spaces causing unpack errors).

Common situations: Reusing Basic-auth code against this server; API gateways rewriting the scheme; copy-paste errors in curl commands.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Not authenticated
• Invalid base64-encoded token.
• Invalid username or password.
• Unsupported file format. Please use .json or .env files.
• [Error] -> {e}

AI-assisted analysis of OpenBB-finance/OpenBB@3e071fcc2c (2026-08-14). Data as JSON: /api/errors/2ae8e1f8c01be1a1. Report an issue: GitHub.