abpframework/abp · error · AbpAuthorizationException

Expected Dapr App API Token is not provided! Dapr should set

Error message

Expected Dapr App API Token is not provided! Dapr should set the 'dapr-api-token' HTTP header.

What it means

Thrown by DaprAppApiTokenValidator.CheckDaprAppApiToken when an App API token is configured on the host (IDaprApiTokenProvider.GetAppApiToken returns a non-empty value) but the incoming HTTP request has no 'dapr-api-token' header. ABP uses this to guarantee that a request to a Dapr-invoked endpoint actually originated from the Dapr sidecar, which injects the header when 'app-api-token' is set in Dapr config.

Source

Thrown at framework/src/Volo.Abp.AspNetCore.Mvc.Dapr/Volo/Abp/AspNetCore/Mvc/Dapr/DaprAppApiTokenValidator.cs:31

    protected HttpContext HttpContext => GetHttpContext();

    public DaprAppApiTokenValidator(IHttpContextAccessor httpContextAccessor)
    {
        HttpContextAccessor = httpContextAccessor;
    }

    public virtual void CheckDaprAppApiToken()
    {
        var expectedAppApiToken = GetConfiguredAppApiTokenOrNull();
        if (expectedAppApiToken.IsNullOrWhiteSpace())
        {
            return;
        }

        var headerAppApiToken = GetDaprAppApiTokenOrNull();
        if (headerAppApiToken.IsNullOrWhiteSpace())
        {
            throw new AbpAuthorizationException("Expected Dapr App API Token is not provided! Dapr should set the 'dapr-api-token' HTTP header.");
        }

        if (expectedAppApiToken != headerAppApiToken)
        {
            throw new AbpAuthorizationException("The Dapr App API Token (provided in the 'dapr-api-token' HTTP header) doesn't match the expected value!");
        }
    }

    public virtual bool IsValidDaprAppApiToken()
    {
        var expectedAppApiToken = GetConfiguredAppApiTokenOrNull();
        if (expectedAppApiToken.IsNullOrWhiteSpace())
        {
            return true;
        }

        var headerAppApiToken = GetDaprAppApiTokenOrNull();
        return expectedAppApiToken == headerAppApiToken;

View on GitHub (pinned to 7ed43b1931)

Solutions

Set the 'app-api-token' secret / '--app-api-token' flag on the Dapr sidecar so it sends the matching 'dapr-api-token' header.
Ensure the token value in Dapr config equals the AppApiToken configured in the ABP host (IDaprApiTokenProvider / AbpDaprOptions).
During local development, temporarily remove the AppApiToken config so CheckDaprAppApiToken short-circuits and returns.
If calling the endpoint outside Dapr, add the 'dapr-api-token' header manually with the configured value.

Example fix

// before: host has AppApiToken set, but request lacks the header
//  -> AbpAuthorizationException: Expected Dapr App API Token is not provided!

// after: configure the Dapr sidecar secret
dapr run --app-id myapp --app-api-token $APP_API_TOKEN -- ...
// and in host config set the same value:
// "Dapr": { "AppApiToken": "<same value>" }

Defensive patterns

Strategy: validation

Validate before calling

// Before relying on the endpoint, ensure the token is set on both sides.
var configured = daprApiTokenProvider.GetAppApiToken();
var header = httpContext.Request.Headers["dapr-api-token"];
if (!string.IsNullOrEmpty(configured) && string.IsNullOrEmpty(header))
{
    // caller must add the header; reject/401 early with guidance
}

Type guard

null

Try / catch

try { daprAppApiTokenValidator.CheckDaprAppApiToken(); }
catch (AbpAuthorizationException ex) when (ex.Message.Contains("not provided"))
{ /* return 401 / instruct caller to send dapr-api-token */ }

Prevention

Configure the matching 'app-api-token' on the Dapr sidecar whenever you set AppApiToken in the host.
Keep the token in a single secret store referenced by both sides.
In local dev, leave AppApiToken unset to bypass validation.
Automate syncing the token on rotation (CI/CD).

When it happens

Trigger: Calling CheckDaprAppApiToken() (directly or via a Dapr endpoint filter) on a request whose 'dapr-api-token' header is absent, while AbpDaprOptions.AppApiToken / the configured token is non-empty.

Common situations: Configuring AppApiToken in the host but forgetting to set the matching 'app-api-token' secret in Dapr's config; Dapr sidecar restarted without the token annotation; a non-Dapr client (browser, curl, integration test) hitting the endpoint directly; token rotation where only one side was updated.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/2f46fa4f31017558. Report an issue: GitHub.