{"record":{"id":"4efd253d0235d9a8","repo":"OpenBB-finance/OpenBB","slug":"invalid-base64-encoded-token","errorCode":null,"errorMessage":"Invalid base64-encoded token.","messagePattern":"Invalid base64-encoded token\\.","errorType":"http","errorClass":"ValueError","httpStatus":401,"severity":"error","filePath":"openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py","lineNumber":57,"sourceCode":"\n        auth_header = request.headers.get(\"Authorization\")\n        if not auth_header:\n            raise HTTPException(\n                status_code=401,\n                detail=\"Not authenticated\",\n                headers={\"WWW-Authenticate\": \"Bearer\"},\n            )\n\n        try:\n            scheme, token = auth_header.split()\n            if scheme.lower() != \"bearer\":\n                raise ValueError(\"Invalid authentication scheme.\")\n\n            try:\n                decoded = base64.b64decode(token).decode(\"utf-8\")\n                username, password = decoded.split(\":\", 1)\n            except (binascii.Error, ValueError) as e:\n                raise ValueError(\"Invalid base64-encoded token.\") from e\n\n            expected_username, expected_password = self.server_auth\n\n            is_user_valid = secrets.compare_digest(username, expected_username)\n            is_pass_valid = secrets.compare_digest(password, expected_password)\n\n            if not (is_user_valid and is_pass_valid):\n                raise ValueError(\"Invalid username or password.\")\n\n            request.state.user = {\"username\": username}\n        except (ValueError, HTTPException) as e:\n            detail = getattr(e, \"detail\", str(e))\n            raise HTTPException(\n                status_code=401,\n                detail=detail,\n                headers={\"WWW-Authenticate\": \"Bearer\"},\n            ) from e\n","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/OpenBB-finance/OpenBB/blob/3e071fcc2cd9f891cac6040ae60296dba76dab46/openbb_platform/extensions/mcp_server/openbb_mcp_server/app/auth.py#L39-L75","documentation":"Raised when the Bearer token cannot be base64-decoded into a 'username:password' string. The server expects base64(credentials) where credentials contain a colon separator; binascii.Error from b64decode or a ValueError from the split (no colon present, or non-UTF-8 bytes) both map to this message, which is then returned as HTTP 401.","triggerScenarios":"Sending a raw (non-base64) username:password string as the token; base64-encoding a string without a colon; sending an opaque OAuth access token where the server expects base64 user:pass; malformed padding in the base64.","commonSituations":"Confusion between this server's basic-style bearer scheme and real OAuth JWT bearer tokens; clients passing API keys directly; encoding bugs that drop the colon.","solutions":["Build the token as base64('username:password') — e.g. printf '%s:%s' \"$U:$P\" | base64.","Ensure the decoded string contains exactly one colon separator (colon in password is fine; split uses maxsplit=1).","Do not send JWTs or API keys as the bearer token to this auth mode."],"exampleFix":"# before\nheaders = {\"Authorization\": \"Bearer my_api_key\"}\n\n# after\nimport base64\ntoken = base64.b64encode(f\"{user}:{password}\".encode()).decode()\nheaders = {\"Authorization\": f\"Bearer {token}\"}","handlingStrategy":"validation","validationCode":"import base64\n\ndef make_bearer_token(username: str, password: str) -> str:\n    raw = f\"{username}:{password}\"\n    if \":\" not in raw:\n        raise ValueError(\"credentials must contain a colon separator\")\n    return base64.b64encode(raw.encode(\"utf-8\")).decode(\"ascii\")","typeGuard":"def is_valid_bearer_payload(token: str) -> bool:\n    try:\n        decoded = base64.b64decode(token, validate=True).decode(\"utf-8\")\n        return \":\" in decoded\n    except Exception:\n        return False","tryCatchPattern":"try:\n    await client.call_tool(\"list_categories\", {})\nexcept Exception as e:\n    if \"Invalid base64-encoded token\" in str(getattr(e, \"detail\", e)):\n        token = make_bearer_token(USER, PASS)  # rebuild correctly, retry once\n        await client.call_tool(\"list_categories\", {})\n    else:\n        raise","preventionTips":["Never send raw passwords, JWTs, or API keys as the token — only base64(user:pass).","Unit-test the token builder against the server's decode logic (b64decode + colon split).","URL-safe base64 variants are not accepted; use standard base64."],"tags":["openbb","mcp","authentication","encoding"],"backgroundTag":null,"analyzedSha":"3e071fcc2cd9f891cac6040ae60296dba76dab46","analyzedAt":"2026-08-14T23:40:48.960Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}