{"record":{"id":"04689ea8834397bd","repo":"alibaba/open-code-review","slug":"invalid-auth-header-w","errorCode":null,"errorMessage":"invalid auth_header: %w","messagePattern":"invalid auth_header: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/opencodereview/provider_cmd.go","lineNumber":118,"sourceCode":"\treturn result\n}\n\nfunc applyManualConfig(configPath string, cfg *Config, result providerTUIResult) error {\n\tif result.url == \"\" {\n\t\treturn fmt.Errorf(\"URL is required for manual configuration\")\n\t}\n\tif result.model == \"\" {\n\t\treturn fmt.Errorf(\"model is required for manual configuration\")\n\t}\n\n\tcfg.Provider = \"\"\n\tcfg.Model = \"\"\n\tcfg.Llm.URL = result.url\n\tcfg.Llm.Model = result.model\n\tcfg.Llm.AuthToken = result.apiKey\n\tauthHeader, err := llm.NormalizeAuthHeader(result.authHeader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid auth_header: %w\", err)\n\t}\n\tcfg.Llm.AuthHeader = authHeader\n\t// Write the canonical protocol so resolver picks it up directly. Also\n\t// mirror use_anthropic so configs read correctly on older binaries that\n\t// predate llm.protocol: anthropic -> true, the OpenAI family (including\n\t// openai-responses, which has no exact boolean equivalent) -> false, so\n\t// older binaries pick the OpenAI auth header/endpoint instead of wrongly\n\t// defaulting to anthropic.\n\tprotocol := llm.NormalizeProtocol(result.protocol)\n\tcfg.Llm.Protocol = protocol\n\tswitch protocol {\n\tcase llm.ProtocolAnthropic:\n\t\tt := true\n\t\tcfg.Llm.UseAnthropic = &t\n\tdefault:\n\t\tf := false\n\t\tcfg.Llm.UseAnthropic = &f\n\t}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/cmd/opencodereview/provider_cmd.go#L100-L136","documentation":"This error wraps a failure from llm.NormalizeAuthHeader when saving a manual provider config. NormalizeAuthHeader validates the custom Authorization header value (e.g. it must carry a valid scheme like Bearer) and rejects malformed input, so an invalid auth_header in the TUI result blocks the config save.","triggerScenarios":"Confirming manual configuration in `ocr config provider` with an auth_header value that NormalizeAuthHeader rejects — e.g. missing the authorization scheme prefix, empty key/value structure, or otherwise malformed header syntax.","commonSituations":"Pasting only the token without the `Bearer ` prefix when the field expects the full header value; typos or stray whitespace/quotes in the header string; copying a header from a different provider with a scheme the validator doesn't accept.","solutions":["Reopen `ocr config provider` and correct the auth_header — include the full value with its scheme, e.g. `Bearer <token>`.","If you only have a raw token, put it in the API key field and leave auth_header empty — NormalizeAuthHeader is only for custom header overrides.","Read the wrapped cause after 'invalid auth_header:' for the exact validation rule that failed.","Strip surrounding quotes/whitespace when pasting the header value."],"exampleFix":"// before (missing scheme)\nresult.authHeader = \"sk-abc123\"\n// after\nresult.authHeader = \"Bearer sk-abc123\"","handlingStrategy":"validation","validationCode":"h, err := llm.NormalizeAuthHeader(result.authHeader)\nif err != nil {\n    return fmt.Errorf(\"invalid auth_header: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := applyManualConfig(path, cfg, result); err != nil {\n    var normErr *llm.AuthHeaderError\n    if errors.As(err, &normErr) { /* fix header scheme/format and retry */ }\n}","preventionTips":["Include the full header value with scheme: `Bearer <token>`, not just the token.","Leave auth_header empty if you only have a raw API key — use the API key field.","Trim whitespace and quotes when pasting header values.","Verify the header with curl -H before saving it in config."],"tags":["validation","auth","config","http-headers"],"backgroundTag":"invalid-auth-header","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}