{"id":"061da1733d18753a","repo":"tiangolo/fastapi","slug":"x-token-header-invalid-061da1","errorCode":null,"errorMessage":"X-Token header invalid","messagePattern":"X-Token header invalid","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"docs_src/dependencies/tutorial006_an_py310.py","lineNumber":10,"sourceCode":"from typing import Annotated\n\nfrom fastapi import Depends, FastAPI, Header, HTTPException\n\napp = FastAPI()\n\n\nasync def verify_token(x_token: Annotated[str, Header()]):\n    if x_token != \"fake-super-secret-token\":\n        raise HTTPException(status_code=400, detail=\"X-Token header invalid\")\n\n\nasync def verify_key(x_key: Annotated[str, Header()]):\n    if x_key != \"fake-super-secret-key\":\n        raise HTTPException(status_code=400, detail=\"X-Key header invalid\")\n    return x_key\n\n\n@app.get(\"/items/\", dependencies=[Depends(verify_token), Depends(verify_key)])\nasync def read_items():\n    return [{\"item\": \"Foo\"}, {\"item\": \"Bar\"}]\n","sourceCodeStart":1,"sourceCodeEnd":22,"githubUrl":"https://github.com/tiangolo/fastapi/blob/42a41db11f6882807ac3c057b942178d53b97438/docs_src/dependencies/tutorial006_an_py310.py#L1-L22","documentation":"Raised by the verify_token dependency (Annotated variant) when X-Token != \"fake-super-secret-token\", returning HTTP 400. The dependency is registered via dependencies=[Depends(verify_token), Depends(verify_key)] on GET /items/, so it is an access-control gate that runs before the route body executes.","triggerScenarios":"GET /items/ without X-Token header equal to \"fake-super-secret-token\".","commonSituations":"Missing token header in the client; secret mismatch after rotation; forgetting the dependency also requires X-Key.","solutions":["Send X-Token: fake-super-secret-token (and also X-Key, see error 15).","Keep the secret in shared config.","Confirm both header dependencies are satisfied."],"exampleFix":"# before\nclient.get(\"/items/\")\n# after\nclient.get(\"/items/\", headers={\"X-Token\":\"fake-super-secret-token\",\"X-Key\":\"fake-super-secret-key\"})","handlingStrategy":"validation","validationCode":"TOKEN = \"fake-super-secret-token\"\nKEY = \"fake-super-secret-key\"\nheaders = {\"X-Token\": TOKEN, \"X-Key\": KEY}\nclient.get(\"/items/\", headers=headers)","typeGuard":"def has_both_headers(h: dict) -> bool:\n    return h.get(\"X-Token\") == \"fake-super-secret-token\" and h.get(\"X-Key\") == \"fake-super-secret-key\"","tryCatchPattern":null,"preventionTips":["Satisfy both header dependencies (token and key).","Build headers once and reuse.","Keep secrets in shared config."],"tags":["fastapi","authentication","dependencies","http-headers"],"analyzedSha":"42a41db11f6882807ac3c057b942178d53b97438","analyzedAt":"2026-08-04T19:23:32.007Z","schemaVersion":2}