crewAIInc/crewAI · error · HTTPException

Authentication not configured

Error message

Authentication not configured

What it means

Raised by SimpleTokenAuth.authenticate() when neither the scheme's `token` field nor the AUTH_TOKEN environment variable is set, so the server has no expected value to compare incoming bearer tokens against. It surfaces as an HTTP 401 with detail 'Authentication not configured' even though the real cause is a missing server-side configuration, not bad client credentials. The warning log carries reason='no_token_configured' to distinguish it from a token mismatch.

Source

Thrown at lib/crewai/src/crewai/a2a/auth/server_schemes.py:172

        """Authenticate using simple token comparison.

        Args:
            token: The bearer token to authenticate.

        Returns:
            AuthenticatedUser on successful authentication.

        Raises:
            HTTPException: If authentication fails.
        """
        expected = self._get_expected_token()

        if expected is None:
            logger.warning(
                "Simple token authentication failed",
                extra={"reason": "no_token_configured"},
            )
            raise HTTPException(
                status_code=HTTP_401_UNAUTHORIZED,
                detail="Authentication not configured",
            )

        if token != expected:
            raise HTTPException(
                status_code=HTTP_401_UNAUTHORIZED,
                detail="Invalid or missing authentication credentials",
            )

        return AuthenticatedUser(
            token=token,
            scheme="simple_token",
        )


class EnterpriseTokenAuth(ServerAuthScheme):
    """Enterprise token authentication.

View on GitHub (pinned to 754d7323be)

Solutions

1. Set the expected token explicitly: SimpleTokenAuth(token='your-secret-token').
2. Or export AUTH_TOKEN in the environment where the A2A server process runs (docker-compose env, .env loaded before startup, k8s secret).
3. Fail fast at startup instead of per-request: assert os.environ.get('AUTH_TOKEN') or scheme.token is not None before binding the server.
4. If this env is intentionally unauthenticated, remove the SimpleTokenAuth scheme from the server config rather than leaving it half-configured.

Example fix

// before
auth = SimpleTokenAuth()  # AUTH_TOKEN unset -> every request 401

# after
import os
from crewai.a2a.auth.server_schemes import SimpleTokenAuth

assert os.environ.get("AUTH_TOKEN"), "AUTH_TOKEN must be set for SimpleTokenAuth"
auth = SimpleTokenAuth()  # now falls back to AUTH_TOKEN
# or explicitly:
auth = SimpleTokenAuth(token="your-secret-token")

import os
from crewai.a2a.auth.server_schemes import SimpleTokenAuth

# before binding the server, prove the scheme has an expected token
probe = SimpleTokenAuth() if using_env_fallback else scheme
assert scheme.token is not None or os.environ.get("AUTH_TOKEN"), (
    "SimpleTokenAuth has no token: set `token` or the AUTH_TOKEN env var"
)

When it happens

Trigger: Constructing SimpleTokenAuth() with no `token` argument while AUTH_TOKEN is unset in the process environment, then receiving any authenticated request: authenticate() calls _get_expected_token(), gets None, and raises before comparing the client's token.

Common situations: Deploying an A2A server where AUTH_TOKEN was set in the shell but not passed into the container/service environment; defining the scheme in config with an empty token string; running tests locally without the env var; CI environments that strip secrets.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Zapier Actions API key is required
• Authorization callback not set. Use set_authorization_callba
• Error. A valid pyproject.toml file is required. Check that a
• Error: {e}
• Project name cannot be empty or contain only whitespace

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/b5aad940a450051c. Report an issue: GitHub.