abpframework/abp · error · AbpAuthorizationException

The Dapr App API Token (provided in the 'dapr-api-token' HTT

Error message

The Dapr App API Token (provided in the 'dapr-api-token' HTTP header) doesn't match the expected value!

What it means

Thrown by DaprAppApiTokenValidator.CheckDaprAppApiToken when both an expected token is configured AND a 'dapr-api-token' header is present, but the two values differ. This is a constant-time-ish equality miss: the request looks like a Dapr call but the secret does not match, so ABP rejects it as an authorization failure.

Source

Thrown at framework/src/Volo.Abp.AspNetCore.Mvc.Dapr/Volo/Abp/AspNetCore/Mvc/Dapr/DaprAppApiTokenValidator.cs:36

    }

    public virtual void CheckDaprAppApiToken()
    {
        var expectedAppApiToken = GetConfiguredAppApiTokenOrNull();
        if (expectedAppApiToken.IsNullOrWhiteSpace())
        {
            return;
        }

        var headerAppApiToken = GetDaprAppApiTokenOrNull();
        if (headerAppApiToken.IsNullOrWhiteSpace())
        {
            throw new AbpAuthorizationException("Expected Dapr App API Token is not provided! Dapr should set the 'dapr-api-token' HTTP header.");
        }

        if (expectedAppApiToken != headerAppApiToken)
        {
            throw new AbpAuthorizationException("The Dapr App API Token (provided in the 'dapr-api-token' HTTP header) doesn't match the expected value!");
        }
    }

    public virtual bool IsValidDaprAppApiToken()
    {
        var expectedAppApiToken = GetConfiguredAppApiTokenOrNull();
        if (expectedAppApiToken.IsNullOrWhiteSpace())
        {
            return true;
        }

        var headerAppApiToken = GetDaprAppApiTokenOrNull();
        return expectedAppApiToken == headerAppApiToken;
    }

    public virtual string? GetDaprAppApiTokenOrNull()
    {
        string? apiTokenHeader = HttpContext.Request.Headers["dapr-api-token"];

View on GitHub (pinned to 7ed43b1931)

Solutions

Verify the configured AppApiToken in the host exactly equals the 'app-api-token' secret supplied to Dapr (trim whitespace, compare byte-for-byte).
Re-issue the token from a single source and redeploy both the host and the Dapr secret together.
Check for trailing newlines in the secret (common when reading from a file/k8s secret).
Temporarily log the expected-vs-header length (not the value) to confirm a mismatch cause.

Example fix

// before: tokens differ -> AbpAuthorizationException: ... doesn't match

// after: derive both from one secret
# host: "Dapr": { "AppApiToken": "${DAPR_APP_API_TOKEN}" }
# dapr: dapr run --app-api-token "$DAPR_APP_API_TOKEN" ...

Defensive patterns

Strategy: try-catch

Validate before calling

var expected = daprApiTokenProvider.GetAppApiToken();
var header = httpContext.Request.Headers["dapr-api-token"].ToString();
if (!string.IsNullOrEmpty(expected) && expected != header)
{
    // mismatch - log lengths (not values), trigger re-sync
}

Type guard

null

Try / catch

try { daprAppApiTokenValidator.CheckDaprAppApiToken(); }
catch (AbpAuthorizationException ex) when (ex.Message.Contains("doesn't match"))
{ /* return 401; trigger token re-sync between host and sidecar */ }

Prevention

Source the token for host and Dapr from the same secret.
Trim whitespace/newlines when reading the secret from files or k8s secrets.
Rotate tokens atomically (both sides redeployed together).
Compare lengths first when debugging mismatches (never log the value).

When it happens

Trigger: CheckDaprAppApiToken() runs on a request that carries a 'dapr-api-token' header whose value != the configured AppApiToken.

Common situations: Token rotated on one side only (host or Dapr); copy/paste typo or trailing whitespace/newline in either the config or the secret; multiple environments (dev token sent to prod host); secret store returned a stale value after redeploy.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/f5cab6c4946cd1e4. Report an issue: GitHub.