RocketChat/Rocket.Chat · error · Error

auth option should be of the form "username:password"

Error message

auth option should be of the form "username:password"

What it means

When an App makes an HTTP request with `options.auth`, `AppHttpBridge.call` (http.ts:36-43) builds a Basic auth header by base64-encoding the value. It first checks for a ':' separator; if none is present it throws before the request is sent. Per IHttpRequest (apps-engine IHttp.ts:37), `auth` must be in the form 'username:password'.

Source

Thrown at apps/meteor/app/apps/server/bridges/http.ts:38

	}

	protected async call(info: IHttpBridgeRequestInfo): Promise<IHttpResponse> {
		// begin comptability with old HTTP.call API
		const url = new URL(info.url);

		const { request, method } = info;

		const { headers = {} } = request;

		let { content } = request;

		if (!content && typeof request.data === 'object') {
			content = request.data;
		}

		if (request.auth) {
			if (request.auth.indexOf(':') < 0) {
				throw new Error('auth option should be of the form "username:password"');
			}

			const base64 = Buffer.from(request.auth, 'ascii').toString('base64');
			headers.Authorization = `Basic ${base64}`;
		}

		let paramsForBody;

		if (content || isGetOrHead(method)) {
			if (request.params) {
				Object.keys(request.params).forEach((key) => {
					if (request.params?.[key]) {
						url.searchParams.append(key, request.params?.[key]);
					}
				});
			}
		} else {
			paramsForBody = request.params;

View on GitHub (pinned to f9d3ec372b)

Solutions

1. Format auth as `${username}:${password}`.
2. Set the Authorization header manually if your scheme differs from Basic.
3. Validate `auth.includes(':')` before calling the accessor.

Example fix

// before
await http.get(url, { auth: username })
// after
await http.get(url, { auth: `${username}:${password}` })

if (options.auth != null && !options.auth.includes(':')) {
  throw new Error('IHttpRequest.auth must be "username:password"');
}
await http.get(url, options);

When it happens

Trigger: `http.get(url, { auth: 'useronly' })` — no colon. Also an auth string sourced from config/env that was not formatted as user:password.

Common situations: Username-only value passed; concatenating user+password without a ':'; typo in templating; credentials read from a secret store that returns them as separate fields.

Related errors

• Invalid Api parameter provided, it must be a valid IApi obje
• Invalid command parameter provided, must be a string.
• Invalid Slash Command parameter provided, it must be a valid
• The environmental variable "${envVarName}" is not readable.
• Invalid token for livechat message

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/058d1527fed41f5a. Report an issue: GitHub.