{"record":{"id":"07378981ed625361","repo":"musistudio/claude-code-router","slug":"label-cannot-include-credentials","errorCode":null,"errorMessage":"${label} cannot include credentials.","messagePattern":"(.+?) cannot include credentials\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/providers/manifest-service.ts","lineNumber":216,"sourceCode":"function validateProviderApiKeyTarget(provider: ProviderDeepLinkPayload, endpoint: string): void {\n  const issue = providerEndpointCanReceiveProviderApiKey({\n    apiKey: \"manifest-provider-api-key\",\n    endpoint,\n    providerName: provider.name,\n    providerPresetId: findProviderPresetByBaseUrl(provider.baseUrl)?.id\n  });\n  if (issue) {\n    throw new Error(issue.message);\n  }\n}\n\nasync function validatePublicHttpsUrl(value: string, label: string): Promise<void> {\n  const url = new URL(providerUrlWithDefaultScheme(value));\n  if (url.protocol !== \"https:\") {\n    throw new Error(`${label} from a remote manifest must use https.`);\n  }\n  if (url.username || url.password) {\n    throw new Error(`${label} cannot include credentials.`);\n  }\n  validateRemoteHostname(url.hostname, label);\n  await resolveSafeAddress(url.hostname);\n}\n\nfunction validateRemoteHostname(hostname: string, label: string): void {\n  const normalized = hostname.trim().toLowerCase().replace(/\\.$/, \"\");\n  if (!normalized) {\n    throw new Error(`${label} is invalid.`);\n  }\n  if (\n    normalized === \"localhost\" ||\n    normalized.endsWith(\".localhost\") ||\n    normalized.endsWith(\".home\") ||\n    normalized.endsWith(\".lan\") ||\n    normalized.endsWith(\".local\") ||\n    normalized.endsWith(\".internal\")\n  ) {","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/providers/manifest-service.ts#L198-L234","documentation":"validatePublicHttpsUrl throws when a URL from a remote manifest embeds userinfo credentials (user:pass@host). Embedded credentials end up in logs and URLs and are not a supported auth mechanism for manifest endpoints.","triggerScenarios":"provider.baseUrl or a connector endpoint like 'https://user:pass@api.example.com' — the URL parser populates url.username or url.password and the check fires.","commonSituations":"Copy-pasting a dashboard URL that includes basic-auth userinfo; private-registry style URLs pasted into manifest config.","solutions":["Remove the user:pass@ segment from the URL","Pass credentials via the connector's configured auth mechanism (headers/oauth) instead of the URL","Rotate the credentials if they were committed in a shared manifest"],"exampleFix":"// before\n\"baseUrl\": \"https://alice:secret@api.example.com\"\n// after\n\"baseUrl\": \"https://api.example.com\"","handlingStrategy":"validation","validationCode":"const u = new URL(provider.baseUrl);\nif (u.username || u.password) throw new Error('URL must not embed credentials');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never paste URLs containing user:pass@ into shared config","Move credentials to the provider's auth config fields"],"tags":["url-validation","credentials","security","manifest"],"backgroundTag":"url-embedded-credentials","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}