{"record":{"id":"37ce1316575a6025","repo":"crewAIInc/crewAI","slug":"invalid-or-missing-authentication-credentials","errorCode":null,"errorMessage":"Invalid or missing authentication credentials","messagePattern":"Invalid or missing authentication credentials","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"lib/crewai/src/crewai/a2a/auth/server_schemes.py","lineNumber":178,"sourceCode":"            AuthenticatedUser on successful authentication.\n\n        Raises:\n            HTTPException: If authentication fails.\n        \"\"\"\n        expected = self._get_expected_token()\n\n        if expected is None:\n            logger.warning(\n                \"Simple token authentication failed\",\n                extra={\"reason\": \"no_token_configured\"},\n            )\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Authentication not configured\",\n            )\n\n        if token != expected:\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Invalid or missing authentication credentials\",\n            )\n\n        return AuthenticatedUser(\n            token=token,\n            scheme=\"simple_token\",\n        )\n\n\nclass EnterpriseTokenAuth(ServerAuthScheme):\n    \"\"\"Enterprise token authentication.\n\n    Validates tokens via the PlusAPI enterprise verification endpoint.\n    \"\"\"\n\n    async def authenticate(self, token: str) -> AuthenticatedUser:\n        \"\"\"Authenticate using enterprise token verification.","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/crewai/src/crewai/a2a/auth/server_schemes.py#L160-L196","documentation":"Raised by SimpleTokenAuth.authenticate() when the bearer token supplied by the client does not equal the expected token (the scheme's `token` field or the AUTH_TOKEN env var). It is a standard HTTP 401 rejection: the server is configured correctly, but the presented credential is wrong or missing. Comparison is a direct string equality check against the single configured secret.","triggerScenarios":"Any request whose Authorization: Bearer <token> value differs from the configured secret: client sends an old/rotated token, sends 'Bearer' with no value so an empty string is compared, or copies a token from a different environment (dev token against prod server).","commonSituations":"Token rotation where one side was not updated; trailing whitespace or newline included when copying the secret; client library that prefixes/strips the header differently; multiple replicas configured with different AUTH_TOKEN values.","solutions":["Verify the client sends exactly the configured value: header 'Authorization: Bearer <AUTH_TOKEN>' with no extra whitespace or quotes.","Re-check which env the server process actually loaded: print/log whether AUTH_TOKEN or an explicit token field is in effect.","After a rotation, redeploy all clients and all server replicas with the new token.","Strip the token of trailing newlines when reading it from files/CI secrets (token.strip())."],"exampleFix":"# before\nresponse = await client.post(url, headers={\"Authorization\": f\"Bearer {os.environ['TOKEN_FILE_CONTENT}\"} })  # raw content may include \\n\n\n# after\nraw = os.environ[\"TOKEN_FILE_CONTENT\"].strip()\nresponse = await client.post(url, headers={\"Authorization\": f\"Bearer {raw}\"})","handlingStrategy":"validation","validationCode":"import os\n\nexpected = os.environ[\"AUTH_TOKEN\"]\nassert supplied_token == expected, \"token mismatch before sending request\"\nheaders = {\"Authorization\": f\"Bearer {supplied_token.strip()}\"}","typeGuard":null,"tryCatchPattern":"try:\n    result = await scheme.authenticate(token)\nexcept HTTPException as e:\n    if e.status_code == 401:\n        # credential problem: log the client identity, never log the token itself\n        raise","preventionTips":["Strip whitespace/newlines from tokens sourced from files or CI secrets.","Coordinate token rotation across all clients and replicas atomically.","Never log bearer tokens when diagnosing 401s."],"tags":["a2a","authentication","credentials","http-401"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}