{"record":{"id":"2ae8e1f8c01be1a1","repo":"OpenBB-finance/OpenBB","slug":"invalid-authentication-scheme","errorCode":null,"errorMessage":"Invalid authentication scheme.","messagePattern":"Invalid authentication scheme\\.","errorType":"http","errorClass":"ValueError","httpStatus":401,"severity":"error","filePath":"openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py","lineNumber":51,"sourceCode":"        self.token_url = f\"{base_url}/mcp/token\"\n\n    async def authorize(self, request: Request) -> bool:\n        \"\"\"Authorize the request.\"\"\"\n        if not self.server_auth:\n            return True\n\n        auth_header = request.headers.get(\"Authorization\")\n        if not auth_header:\n            raise HTTPException(\n                status_code=401,\n                detail=\"Not authenticated\",\n                headers={\"WWW-Authenticate\": \"Bearer\"},\n            )\n\n        try:\n            scheme, token = auth_header.split()\n            if scheme.lower() != \"bearer\":\n                raise ValueError(\"Invalid authentication scheme.\")\n\n            try:\n                decoded = base64.b64decode(token).decode(\"utf-8\")\n                username, password = decoded.split(\":\", 1)\n            except (binascii.Error, ValueError) as e:\n                raise ValueError(\"Invalid base64-encoded token.\") from e\n\n            expected_username, expected_password = self.server_auth\n\n            is_user_valid = secrets.compare_digest(username, expected_username)\n            is_pass_valid = secrets.compare_digest(password, expected_password)\n\n            if not (is_user_valid and is_pass_valid):\n                raise ValueError(\"Invalid username or password.\")\n\n            request.state.user = {\"username\": username}\n        except (ValueError, HTTPException) as e:\n            detail = getattr(e, \"detail\", str(e))","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/OpenBB-finance/OpenBB/blob/3e071fcc2cd9f891cac6040ae60296dba76dab46/openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py#L33-L69","documentation":"Raised during MCP bearer authentication when the Authorization header's scheme is not 'Bearer' (e.g. 'Basic ...' or 'Token ...'). The server splits the header and rejects any scheme whose lowercase form is not 'bearer'. The ValueError is caught and re-raised as HTTP 401 with the same detail, so the client sees an authentication failure.","triggerScenarios":"Sending 'Authorization: Basic <base64>' or 'Authorization: Token abc' to the MCP endpoint; clients defaulting to a different scheme; hand-rolled headers using 'bearer' variants that don't survive splitting (e.g. multiple spaces causing unpack errors).","commonSituations":"Reusing Basic-auth code against this server; API gateways rewriting the scheme; copy-paste errors in curl commands.","solutions":["Use exactly 'Authorization: Bearer <credentials>' with the literal scheme 'Bearer'.","Update the client's auth type to bearer-only for this server.","Check any intermediary that may rewrite the Authorization header."],"exampleFix":"# before\ncurl -H \"Authorization: Basic dXNlcjpwYXNz\" http://localhost:8000/mcp\n\n# after\ncurl -H \"Authorization: Bearer dXNlcjpwYXNz\" http://localhost:8000/mcp  # scheme must be Bearer","handlingStrategy":"validation","validationCode":"def bearer_header(auth_header: str) -> str:\n    scheme = auth_header.split(None, 1)[0] if auth_header else \"\"\n    if scheme.lower() != \"bearer\":\n        raise ValueError(f\"scheme must be Bearer, got {scheme!r}\")\n    return auth_header","typeGuard":"def is_bearer(auth_header: str | None) -> bool:\n    return bool(auth_header) and auth_header.split(None, 1)[0].lower() == \"bearer\"","tryCatchPattern":"try:\n    await client.call_tool(\"list_categories\", {})\nexcept Exception as e:\n    detail = getattr(e, \"detail\", str(e))\n    if \"Invalid authentication scheme\" in str(detail):\n        session.headers[\"Authorization\"] = f\"Bearer {token}\"  # fix scheme, retry once\n        await client.call_tool(\"list_categories\", {})\n    else:\n        raise","preventionTips":["Always build the header as f\"Bearer {token}\" — never Basic/Token for this server.","Centralize header construction in one helper to avoid per-call mistakes.","Check that gateways do not rewrite the auth scheme."],"tags":["openbb","mcp","authentication","http-401"],"backgroundTag":null,"analyzedSha":"3e071fcc2cd9f891cac6040ae60296dba76dab46","analyzedAt":"2026-08-14T23:40:48.960Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}