alibaba/open-code-review · error

invalid auth_header: %w

Error message

invalid auth_header: %w

What it means

This error wraps a failure from llm.NormalizeAuthHeader when saving a manual provider config. NormalizeAuthHeader validates the custom Authorization header value (e.g. it must carry a valid scheme like Bearer) and rejects malformed input, so an invalid auth_header in the TUI result blocks the config save.

Source

Thrown at cmd/opencodereview/provider_cmd.go:118

	return result
}

func applyManualConfig(configPath string, cfg *Config, result providerTUIResult) error {
	if result.url == "" {
		return fmt.Errorf("URL is required for manual configuration")
	}
	if result.model == "" {
		return fmt.Errorf("model is required for manual configuration")
	}

	cfg.Provider = ""
	cfg.Model = ""
	cfg.Llm.URL = result.url
	cfg.Llm.Model = result.model
	cfg.Llm.AuthToken = result.apiKey
	authHeader, err := llm.NormalizeAuthHeader(result.authHeader)
	if err != nil {
		return fmt.Errorf("invalid auth_header: %w", err)
	}
	cfg.Llm.AuthHeader = authHeader
	// Write the canonical protocol so resolver picks it up directly. Also
	// mirror use_anthropic so configs read correctly on older binaries that
	// predate llm.protocol: anthropic -> true, the OpenAI family (including
	// openai-responses, which has no exact boolean equivalent) -> false, so
	// older binaries pick the OpenAI auth header/endpoint instead of wrongly
	// defaulting to anthropic.
	protocol := llm.NormalizeProtocol(result.protocol)
	cfg.Llm.Protocol = protocol
	switch protocol {
	case llm.ProtocolAnthropic:
		t := true
		cfg.Llm.UseAnthropic = &t
	default:
		f := false
		cfg.Llm.UseAnthropic = &f
	}

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Reopen `ocr config provider` and correct the auth_header — include the full value with its scheme, e.g. `Bearer <token>`.
2. If you only have a raw token, put it in the API key field and leave auth_header empty — NormalizeAuthHeader is only for custom header overrides.
3. Read the wrapped cause after 'invalid auth_header:' for the exact validation rule that failed.
4. Strip surrounding quotes/whitespace when pasting the header value.

Example fix

// before (missing scheme)
result.authHeader = "sk-abc123"
// after
result.authHeader = "Bearer sk-abc123"

h, err := llm.NormalizeAuthHeader(result.authHeader)
if err != nil {
    return fmt.Errorf("invalid auth_header: %w", err)
}

if err := applyManualConfig(path, cfg, result); err != nil {
    var normErr *llm.AuthHeaderError
    if errors.As(err, &normErr) { /* fix header scheme/format and retry */ }
}

When it happens

Trigger: Confirming manual configuration in `ocr config provider` with an auth_header value that NormalizeAuthHeader rejects — e.g. missing the authorization scheme prefix, empty key/value structure, or otherwise malformed header syntax.

Common situations: Pasting only the token without the `Bearer ` prefix when the field expects the full header value; typos or stray whitespace/quotes in the header string; copying a header from a different provider with a scheme the validator doesn't accept.

Related errors

• unsupported auth_header value %q; expected "x-api-key" or "a
• header name must not be empty
• header value for %q must not be empty
• invalid extra header %q: expected key=value
• invalid max_tokens %q: must be a positive integer

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/04689ea8834397bd. Report an issue: GitHub.