{"record":{"id":"6247c07c097821e8","repo":"different-ai/openwork","slug":"an-api-key-connection-requires-a-non-empty-token","errorCode":null,"errorMessage":"An API key connection requires a non-empty token.","messagePattern":"An API key connection requires a non-empty token\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/enterprise-mcp-client/src/enterprise-mcp-client.ts","lineNumber":101,"sourceCode":"  client: Client\n  transport: StreamableHTTPClientTransport\n  serverUrl: URL\n  oauthProvider?: EnterpriseMcpOAuthProvider\n  observer: EnterpriseMcpRequestObserver\n  controller: AbortController\n  requestOptions: RequestOptions\n  lifecycle: EnterpriseMcpLifecycle\n}\n\nfunction requestInit(authorization: EnterpriseMcpAuthorization): RequestInit | undefined {\n  if (authorization.type !== \"api-key\") return undefined\n  return { headers: { authorization: `Bearer ${authorization.token}` } }\n}\n\nfunction validateConnection(connection: EnterpriseMcpConnection): URL {\n  const parsed = connectionSchema.parse({ id: connection.id, serverUrl: connection.serverUrl })\n  if (connection.authorization.type === \"api-key\" && !connection.authorization.token.trim()) {\n    throw new Error(\"An API key connection requires a non-empty token.\")\n  }\n  const url = new URL(parsed.serverUrl)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP server URL must use HTTP or HTTPS.\")\n  }\n  if (url.username || url.password) {\n    throw new Error(\"An enterprise MCP server URL cannot contain embedded credentials.\")\n  }\n  if (url.hash) throw new Error(\"An enterprise MCP server URL cannot contain a fragment.\")\n  return url\n}\n\nfunction validateRedirectUri(redirectUri: string): string {\n  const parsed = redirectUriSchema.parse(redirectUri)\n  const url = new URL(parsed)\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"An enterprise MCP OAuth redirect URI must use HTTP or HTTPS.\")\n  }","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/enterprise-mcp-client/src/enterprise-mcp-client.ts#L83-L119","documentation":"validateConnection in packages/enterprise-mcp-client/src/enterprise-mcp-client.ts throws when a connection's authorization.type is \"api-key\" and its token is empty or whitespace-only. The library sends the token as a Bearer Authorization header, so an empty token would produce guaranteed 401s and potentially leak header semantics; it fails fast at connection creation instead.","triggerScenarios":"Creating an EnterpriseMcpConnection (via the client factory or connect) with authorization: { type: \"api-key\", token: \"\" } or token: \"   \" — any value whose .trim() is empty.","commonSituations":"Reading the token from an env var like process.env.MCP_API_KEY that is undefined/empty and interpolating it into the token field; YAML/JSON config with a placeholder left blank; a secrets manager returning an empty secret.","solutions":["Set a real API key token on the connection's authorization object before creating the client.","Check the env variable or secret source actually resolves at runtime (e.g. process.env.API_KEY may be undefined).","If the server uses OAuth instead of an API key, switch authorization to the appropriate type rather than leaving an empty api-key token."],"exampleFix":"// before\nauthorization: { type: \"api-key\", token: process.env.MCP_API_KEY ?? \"\" }\n\n// after\nif (!process.env.MCP_API_KEY) throw new Error(\"MCP_API_KEY is required\")\nauthorization: { type: \"api-key\", token: process.env.MCP_API_KEY }","handlingStrategy":"validation","validationCode":"function assertApiKeyConnection(c) {\n  if (c.authorization.type === \"api-key\" && !c.authorization.token?.trim()) {\n    throw new Error(\"api-key token must be non-empty before creating the connection\")\n  }\n}","typeGuard":"function hasApiKeyToken(a: EnterpriseMcpAuthorization): a is Extract<EnterpriseMcpAuthorization, { type: \"api-key\"; token: string }> {\n  return a.type === \"api-key\" && typeof a.token === \"string\" && a.token.trim().length > 0\n}","tryCatchPattern":null,"preventionTips":["Fail fast at startup when required env vars/secrets are missing instead of interpolating empty strings","Trim and check tokens before constructing the connection object","Keep secrets out of config files; load them from a secrets manager with existence checks"],"tags":["configuration","api-key","authentication"],"backgroundTag":"missing-api-key","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}