{"record":{"id":"f28b381a4d46d17b","repo":"iflytek/astron-agent","slug":"codeenum-param-error","errorCode":"CodeEnum.PARAM_ERROR","errorMessage":"authorization header is invalid","messagePattern":"authorization header is invalid","errorType":"error_code","errorClass":"CustomException","httpStatus":null,"severity":"error","filePath":"core/workflow/extensions/fastapi/middleware/auth.py","lineNumber":266,"sourceCode":"        headers[TENANT_INTERNAL_API_KEY_HEADER] = self.api_secret\n        return headers\n\n    async def _get_app_source_detail_with_api_key(\n        self, authorization: str, span: Span\n    ) -> str:\n        \"\"\"\n        Get the app source detail with api key\n\n        :param authorization: The authorization header\n        :param span: The span object\n        :return: The app source detail\n        \"\"\"\n\n        try:\n            scheme, credential = authorization.split(\" \", 1)\n            api_key, api_secret = credential.strip().split(\":\", 1)\n        except ValueError as exc:\n            raise CustomException(\n                CodeEnum.PARAM_ERROR,\n                err_msg=\"authorization header is invalid\",\n            ) from exc\n        if scheme.lower() != \"bearer\" or not api_key or not api_secret:\n            raise CustomException(\n                CodeEnum.PARAM_ERROR,\n                err_msg=\"authorization header is invalid\",\n            )\n\n        credential_cache_digest = credential_cache_key(credential.strip())\n\n        app_id = await asyncio.to_thread(\n            self._get_app_id_with_cache, credential_cache_digest\n        )\n        if app_id:\n            return app_id\n\n        base_url = os.getenv(\"APP_MANAGE_PLAT_BASE_URL\", \"\").rstrip(\"/\")","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/workflow/extensions/fastapi/middleware/auth.py#L248-L284","documentation":"_get_app_source_detail_with_api_key parses the Authorization header as 'Bearer <api_key>:<api_secret>' in two split steps. If the header lacks the expected separators (no space or no colon), split raises ValueError, which is converted to CustomException with CodeEnum.PARAM_ERROR 'authorization header is invalid'.","triggerScenarios":"Sending Authorization headers like 'Bearer abc' (missing ':secret'), 'abc:def' (missing scheme), or a raw token without the Bearer prefix, so ' '.split(...) or ':'.split(...) fails to produce two parts.","commonSituations":"Clients treating the header as a plain token; SDK updates changing auth format; copy-paste losing the secret part; base64 credentials used where key:secret is expected.","solutions":["Send the header as 'Authorization: Bearer <api_key>:<api_secret>'","Verify both key and secret are present and separated by exactly one colon","Check the HTTP client is not already prepending 'Bearer ' twice or encoding the credential","Log/inspect the raw header shape (mask secrets) to confirm the format"],"exampleFix":"// before\nAuthorization: Bearer sk-abc123\n// after\nAuthorization: Bearer sk-abc123:secret456","handlingStrategy":"validation","validationCode":"parts = authorization.split(\" \", 1)\nok = len(parts) == 2 and \":\" in parts[1]\nassert ok, \"Authorization must be 'Bearer <api_key>:<api_secret>'\"","typeGuard":"def is_valid_auth_header(header: str) -> bool:\n    parts = header.split(\" \", 1)\n    if len(parts) != 2 or \":\" not in parts[1]:\n        return False\n    key, secret = parts[1].split(\":\", 1)\n    return bool(key and secret)","tryCatchPattern":"try:\n    detail = await middleware._get_app_source_detail_with_api_key(request)\nexcept CustomException as e:\n    if e.err_code == CodeEnum.PARAM_ERROR:\n        return JSONResponse(status_code=400, content={\"message\": \"Authorization must be 'Bearer key:secret'\"})\n    raise","preventionTips":["Centralize header construction in one auth helper","Always include both key and secret separated by ':'","Add a client-side format check before sending","Document the expected scheme for SDK consumers"],"tags":["auth","http-header","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}