What causes "Invalid base64-encoded token." in OpenBB-finance/OpenBB?

Build the token as base64('username:password') — e.g. printf '%s:%s' "$U:$P" | base64.

OpenBB-finance/OpenBB · error · ValueError

Invalid base64-encoded token.

Error message

Invalid base64-encoded token.

What it means

Raised when the Bearer token cannot be base64-decoded into a 'username:password' string. The server expects base64(credentials) where credentials contain a colon separator; binascii.Error from b64decode or a ValueError from the split (no colon present, or non-UTF-8 bytes) both map to this message, which is then returned as HTTP 401.

Source

Thrown at openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py:57

        auth_header = request.headers.get("Authorization")
        if not auth_header:
            raise HTTPException(
                status_code=401,
                detail="Not authenticated",
                headers={"WWW-Authenticate": "Bearer"},
            )

        try:
            scheme, token = auth_header.split()
            if scheme.lower() != "bearer":
                raise ValueError("Invalid authentication scheme.")

            try:
                decoded = base64.b64decode(token).decode("utf-8")
                username, password = decoded.split(":", 1)
            except (binascii.Error, ValueError) as e:
                raise ValueError("Invalid base64-encoded token.") from e

            expected_username, expected_password = self.server_auth

            is_user_valid = secrets.compare_digest(username, expected_username)
            is_pass_valid = secrets.compare_digest(password, expected_password)

            if not (is_user_valid and is_pass_valid):
                raise ValueError("Invalid username or password.")

            request.state.user = {"username": username}
        except (ValueError, HTTPException) as e:
            detail = getattr(e, "detail", str(e))
            raise HTTPException(
                status_code=401,
                detail=detail,
                headers={"WWW-Authenticate": "Bearer"},
            ) from e

View on GitHub (pinned to 3e071fcc2c)

Solutions

Build the token as base64('username:password') — e.g. printf '%s:%s' "$U:$P" | base64.
Ensure the decoded string contains exactly one colon separator (colon in password is fine; split uses maxsplit=1).
Do not send JWTs or API keys as the bearer token to this auth mode.

Example fix

# before
headers = {"Authorization": "Bearer my_api_key"}

# after
import base64
token = base64.b64encode(f"{user}:{password}".encode()).decode()
headers = {"Authorization": f"Bearer {token}"}

Defensive patterns

Strategy: validation

Validate before calling

import base64

def make_bearer_token(username: str, password: str) -> str:
    raw = f"{username}:{password}"
    if ":" not in raw:
        raise ValueError("credentials must contain a colon separator")
    return base64.b64encode(raw.encode("utf-8")).decode("ascii")

Type guard

def is_valid_bearer_payload(token: str) -> bool:
    try:
        decoded = base64.b64decode(token, validate=True).decode("utf-8")
        return ":" in decoded
    except Exception:
        return False

Try / catch

try:
    await client.call_tool("list_categories", {})
except Exception as e:
    if "Invalid base64-encoded token" in str(getattr(e, "detail", e)):
        token = make_bearer_token(USER, PASS)  # rebuild correctly, retry once
        await client.call_tool("list_categories", {})
    else:
        raise

Prevention

Never send raw passwords, JWTs, or API keys as the token — only base64(user:pass).
Unit-test the token builder against the server's decode logic (b64decode + colon split).
URL-safe base64 variants are not accepted; use standard base64.

When it happens

Trigger: Sending a raw (non-base64) username:password string as the token; base64-encoding a string without a colon; sending an opaque OAuth access token where the server expects base64 user:pass; malformed padding in the base64.

Common situations: Confusion between this server's basic-style bearer scheme and real OAuth JWT bearer tokens; clients passing API keys directly; encoding bugs that drop the colon.

Related errors

AI-assisted analysis of OpenBB-finance/OpenBB@3e071fcc2c (2026-08-14). Data as JSON: /api/errors/4efd253d0235d9a8. Report an issue: GitHub.