{"record":{"id":"b5aad940a450051c","repo":"crewAIInc/crewAI","slug":"authentication-not-configured","errorCode":null,"errorMessage":"Authentication not configured","messagePattern":"Authentication not configured","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"lib/crewai/src/crewai/a2a/auth/server_schemes.py","lineNumber":172,"sourceCode":"        \"\"\"Authenticate using simple token comparison.\n\n        Args:\n            token: The bearer token to authenticate.\n\n        Returns:\n            AuthenticatedUser on successful authentication.\n\n        Raises:\n            HTTPException: If authentication fails.\n        \"\"\"\n        expected = self._get_expected_token()\n\n        if expected is None:\n            logger.warning(\n                \"Simple token authentication failed\",\n                extra={\"reason\": \"no_token_configured\"},\n            )\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Authentication not configured\",\n            )\n\n        if token != expected:\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Invalid or missing authentication credentials\",\n            )\n\n        return AuthenticatedUser(\n            token=token,\n            scheme=\"simple_token\",\n        )\n\n\nclass EnterpriseTokenAuth(ServerAuthScheme):\n    \"\"\"Enterprise token authentication.","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/crewai/src/crewai/a2a/auth/server_schemes.py#L154-L190","documentation":"Raised by SimpleTokenAuth.authenticate() when neither the scheme's `token` field nor the AUTH_TOKEN environment variable is set, so the server has no expected value to compare incoming bearer tokens against. It surfaces as an HTTP 401 with detail 'Authentication not configured' even though the real cause is a missing server-side configuration, not bad client credentials. The warning log carries reason='no_token_configured' to distinguish it from a token mismatch.","triggerScenarios":"Constructing SimpleTokenAuth() with no `token` argument while AUTH_TOKEN is unset in the process environment, then receiving any authenticated request: authenticate() calls _get_expected_token(), gets None, and raises before comparing the client's token.","commonSituations":"Deploying an A2A server where AUTH_TOKEN was set in the shell but not passed into the container/service environment; defining the scheme in config with an empty token string; running tests locally without the env var; CI environments that strip secrets.","solutions":["Set the expected token explicitly: SimpleTokenAuth(token='your-secret-token').","Or export AUTH_TOKEN in the environment where the A2A server process runs (docker-compose env, .env loaded before startup, k8s secret).","Fail fast at startup instead of per-request: assert os.environ.get('AUTH_TOKEN') or scheme.token is not None before binding the server.","If this env is intentionally unauthenticated, remove the SimpleTokenAuth scheme from the server config rather than leaving it half-configured."],"exampleFix":"// before\nauth = SimpleTokenAuth()  # AUTH_TOKEN unset -> every request 401\n\n# after\nimport os\nfrom crewai.a2a.auth.server_schemes import SimpleTokenAuth\n\nassert os.environ.get(\"AUTH_TOKEN\"), \"AUTH_TOKEN must be set for SimpleTokenAuth\"\nauth = SimpleTokenAuth()  # now falls back to AUTH_TOKEN\n# or explicitly:\nauth = SimpleTokenAuth(token=\"your-secret-token\")","handlingStrategy":"validation","validationCode":"import os\nfrom crewai.a2a.auth.server_schemes import SimpleTokenAuth\n\n# before binding the server, prove the scheme has an expected token\nprobe = SimpleTokenAuth() if using_env_fallback else scheme\nassert scheme.token is not None or os.environ.get(\"AUTH_TOKEN\"), (\n    \"SimpleTokenAuth has no token: set `token` or the AUTH_TOKEN env var\"\n)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast at startup if neither scheme.token nor AUTH_TOKEN is present.","Inject AUTH_TOKEN explicitly in container/service definitions instead of relying on shell exports.","Treat a 401 with detail 'Authentication not configured' as a config bug, not a client problem."],"tags":["a2a","authentication","configuration","env-vars","fastapi"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}