{"record":{"id":"4e7bb2aab001460c","repo":"langgenius/dify","slug":"authorization-header-is-missing","errorCode":null,"errorMessage":"Authorization header is missing.","messagePattern":"Authorization header is missing\\.","errorType":"http","errorClass":"Unauthorized","httpStatus":401,"severity":"error","filePath":"api/controllers/console/admin.py","lineNumber":19,"sourceCode":"from collections.abc import Callable\nfrom functools import wraps\n\nfrom flask import request\nfrom werkzeug.exceptions import Unauthorized\n\nfrom configs import dify_config\nfrom libs.token import extract_access_token\n\n\ndef admin_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:\n    @wraps(view)\n    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:\n        if not dify_config.ADMIN_API_KEY:\n            raise Unauthorized(\"API key is invalid.\")\n\n        auth_token = extract_access_token(request)\n        if not auth_token:\n            raise Unauthorized(\"Authorization header is missing.\")\n        if auth_token != dify_config.ADMIN_API_KEY:\n            raise Unauthorized(\"API key is invalid.\")\n\n        return view(*args, **kwargs)\n\n    return decorated\n","sourceCodeStart":1,"sourceCodeEnd":26,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/admin.py#L1-L26","documentation":" werkzeug Unauthorized (HTTP 401) from admin_required: extract_access_token(request) returned no token, meaning the request lacked a usable Authorization header. The guard requires a Bearer-style token carrying the configured ADMIN_API_KEY. Raised before the key is ever compared, so it is purely a missing-header condition.","triggerScenarios":"Calling an @admin_required endpoint with no Authorization header, an empty one, or a header in a scheme extract_access_token does not accept. Reproducible: curl https://host/console/admin/... with no -H Authorization.","commonSituations":"Operator forgot to pass the admin key on a one-off curl; a monitoring/probe script that hits the admin endpoint without auth headers; client that sends the key in a query param or custom header instead of the expected Authorization scheme.","solutions":["Send Authorization: Bearer <ADMIN_API_KEY> on the request.","If using a different token scheme, switch to the Bearer scheme that extract_access_token expects.","Update the calling script to always attach the header from the configured ADMIN_API_KEY.","Verify the header is not stripped by a proxy/gateway in front of the API."],"exampleFix":"# before\ncurl https://host/console/admin/<route>\n# after\ncurl -H \"Authorization: Bearer $ADMIN_API_KEY\" https://host/console/admin/<route>","handlingStrategy":"validation","validationCode":"def build_admin_headers(api_key: str) -> dict[str, str]:\n    if not api_key:\n        raise ValueError('ADMIN_API_KEY is required')\n    return {'Authorization': f'Bearer {api_key}'}","typeGuard":null,"tryCatchPattern":"from werkzeug.exceptions import Unauthorized\n\ntry:\n    resp = client.get(admin_url, headers={'Authorization': f'Bearer {key}'})\nexcept Unauthorized as exc:\n    if 'missing' in str(exc).lower():\n        attach_authorization_header()\n    raise","preventionTips":["Always send Authorization: Bearer <key> on admin requests.","Centralize admin-header construction in one client helper.","Ensure front proxies do not strip the Authorization header."],"tags":["auth","admin","unauthorized","http-header"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}