alibaba/open-code-review · error

header value for %q must not be empty

Error message

header value for %q must not be empty

What it means

parseMCPHeaders rejects a header whose value is an empty string with "header value for <name> must not be empty". An empty header value is almost always an unset secret or environment-variable expansion, so the config command fails fast instead of sending a useless Authorization header at runtime.

Source

Thrown at cmd/opencodereview/config_cmd.go:946

	}

	cfg.MCPServers[name] = entry
	return nil
}

// parseMCPHeaders parses a JSON object of header key-value pairs.
// Example: {"Authorization": "Bearer $TOKEN", "X-Custom": "value"}
func parseMCPHeaders(value string) (map[string]string, error) {
	var m map[string]string
	if err := json.Unmarshal([]byte(value), &m); err != nil {
		return nil, fmt.Errorf("expected JSON object: %w", err)
	}
	for k, v := range m {
		if k == "" {
			return nil, fmt.Errorf("header name must not be empty")
		}
		if v == "" {
			return nil, fmt.Errorf("header value for %q must not be empty", k)
		}
	}
	return m, nil
}

func (c *Config) ensureTelemetry() {
	if c.Telemetry == nil {
		c.Telemetry = &TelemetryConfig{}
	}
}

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Set the variable before expansion: `export TOKEN=...` then rerun the set command with '{"Authorization":"Bearer $TOKEN"}'
2. Alternatively set the entry and rely on runtime env expansion if supported by the entry format
3. Verify the secret exists in CI/local environment before configuring

Example fix

// before
ocr config set mcp-servers.myserver.headers '{"Authorization": "Bearer $TOKEN"}'   # TOKEN unset -> value ""
// after
export TOKEN=ghp_xxx && ocr config set mcp-servers.myserver.headers '{"Authorization": "Bearer $TOKEN"}'

func valuesNonEmpty(s string) bool {
    var m map[string]string
    if json.Unmarshal([]byte(s), &m) != nil { return false }
    for k, v := range m { if v == "" { return false } }
    return true
}

func missingSecret(m map[string]string, key string) bool { return m[key] == "" }

if err := setMCPServerValue(cfg, name, "headers", raw); err != nil {
    if strings.Contains(err.Error(), "must not be empty") { /* re-export the secret and retry */ }
    return err
}

When it happens

Trigger: `ocr config set mcp-servers.myserver.headers '{"Authorization":""}'` — commonly because $TOKEN was unset/unexported when the shell expanded it, or a secret was never filled in.

Common situations: Environment variable not exported in the current shell; CI secret not configured; placeholder like <token> replaced with empty string by a script.

Related errors

• header name must not be empty
• invalid auth_header: %w
• unsupported auth_header value %q; expected "x-api-key" or "a
• invalid extra header %q: expected key=value
• invalid max_tokens %q: must be a positive integer

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/54d5852a11a2f92f. Report an issue: GitHub.