{"record":{"id":"c7adf719175b421b","repo":"googleapis/mcp-toolbox","slug":"error-parsing-access-token-w","errorCode":null,"errorMessage":"error parsing access token: %w","messagePattern":"error parsing access token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":597,"sourceCode":"\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Not using OAuth or no creator was returned\n\t\t\t\tclientCreator = cc\n\t\t\t}\n\t\t})\n\t\treturn client, clientCreator, err\n\t}\n}\n\nfunc (s *Source) RetrieveClientAndService(accessToken tools.AccessToken) (*bigqueryapi.Client, *bigqueryrestapi.Service, error) {\n\tbqClient := s.BigQueryClient()\n\trestService := s.BigQueryRestService()\n\n\t// Initialize new client if using user OAuth token\n\tif s.UseClientAuthorization() {\n\t\ttokenStr, err := accessToken.ParseBearerToken()\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"error parsing access token: %w\", err)\n\t\t}\n\t\tbqClient, restService, err = s.BigQueryClientCreator()(tokenStr, true)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"error creating client from OAuth access token: %w\", err)\n\t\t}\n\t}\n\treturn bqClient, restService, nil\n}\n\nfunc (s *Source) RunSQL(ctx context.Context, bqClient *bigqueryapi.Client, statement, statementType string, params []bigqueryapi.QueryParameter, connProps []*bigqueryapi.ConnectionProperty, labels map[string]string) (any, error) {\n\tquery := bqClient.Query(statement)\n\tquery.Location = bqClient.Location\n\tif params != nil {\n\t\tquery.Parameters = params\n\t}\n\tif connProps != nil {\n\t\tquery.ConnectionProperties = connProps\n\t}","sourceCodeStart":579,"sourceCodeEnd":615,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L579-L615","documentation":"Raised when the source is configured for user client authorization (UseClientAuthorization) and the incoming request's bearer token cannot be parsed into a valid access token string. The library calls accessToken.ParseBearerToken(), which expects an 'Authorization: Bearer <token>' style header; any malformed or missing token bubbles up wrapped here.","triggerScenarios":"A request reaches a tool on a source with client authorization enabled, but the Authorization header is absent, not prefixed with 'Bearer ', or is otherwise malformed so ParseBearerToken returns an error.","commonSituations":"Client apps forgetting to attach the OAuth token after obtaining it, using 'Basic' instead of 'Bearer' scheme, extra whitespace/quotes in the header, or a proxy stripping the Authorization header.","solutions":["Send a well-formed header: Authorization: Bearer <valid-oauth-token>","Confirm the client actually performs the OAuth flow and passes the resulting token to the toolbox request","Check that no intermediate proxy or gateway strips or rewrites the Authorization header"],"exampleFix":"// before\nreq.Header.Set(\"Authorization\", \"Basic dXNlcjpwYXNz\")\n// after\nreq.Header.Set(\"Authorization\", \"Bearer \"+oauthToken.AccessToken)","handlingStrategy":"validation","validationCode":"tok := r.Header.Get(\"Authorization\")\nif !strings.HasPrefix(tok, \"Bearer \") || len(strings.TrimSpace(strings.TrimPrefix(tok, \"Bearer \"))) == 0 {\n    return errors.New(\"missing or malformed Bearer token\")\n}","typeGuard":"func hasBearerToken(h http.Header) bool {\n    const p = \"Bearer \"\n    return strings.HasPrefix(h.Get(\"Authorization\"), p) && len(h.Get(\"Authorization\")) > len(p)\n}","tryCatchPattern":"client, svc, err := src.RetrieveClientAndService(accessToken)\nif err != nil && strings.Contains(err.Error(), \"error parsing access token\") {\n    http.Error(w, \"attach a valid 'Authorization: Bearer <token>' header\", http.StatusUnauthorized)\n    return\n}","preventionTips":["Always set Authorization: Bearer <token> when client authorization is enabled on the source","Refresh tokens before they expire in client applications","Verify proxies/gateways forward the Authorization header unchanged","Add client-side preflight check that the header scheme is Bearer"],"tags":["oauth","authentication","http-header","bearer-token"],"backgroundTag":"malformed-bearer-token","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}