chroma-core/chroma · error · ValueError

Invalid token transport header: {token_header}. Must be one

Error message

Invalid token transport header: {token_header}. Must be one of {allowed_token_headers}

What it means

Error "Invalid token transport header: {token_header}. Must be one of {allowed_token_headers}" thrown in chroma-core/chroma.

Source

Thrown at chromadb/auth/token_authn/__init__.py:72

def _check_token(token: str) -> None:
    token_str = str(token)
    if not all(c in valid_token_chars for c in token_str):
        raise ValueError(
            "Invalid token. Must contain only ASCII letters, digits, and punctuation."
        )


allowed_token_headers = [
    TokenTransportHeader.AUTHORIZATION.value,
    TokenTransportHeader.X_CHROMA_TOKEN.value,
]


def _check_allowed_token_headers(token_header: str) -> None:
    if token_header not in allowed_token_headers:
        raise ValueError(
            f"Invalid token transport header: {token_header}. "
            f"Must be one of {allowed_token_headers}"
        )


class TokenAuthClientProvider(ClientAuthProvider):
    """
    Client auth provider for token-based auth. Header key will be either
    "Authorization" or "X-Chroma-Token" depending on
    `chroma_auth_token_transport_header`. If the header is "Authorization",
    the token is passed as a bearer token.
    """

    def __init__(self, system: System) -> None:
        super().__init__(system)
        self._settings = system.settings

        system.settings.require("chroma_client_auth_credentials")

View on GitHub (pinned to aecdd12c8a)

When it happens

Trigger: Thrown at chromadb/auth/token_authn/__init__.py:72 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of chroma-core/chroma@aecdd12c8a (2026-08-16). Data as JSON: /api/errors/b2f3ee24922d54ed. Report an issue: GitHub.