{"id":"41e3e679b05f6bf3","repo":"tiangolo/fastapi","slug":"x-token-header-invalid-41e3e6","errorCode":null,"errorMessage":"X-Token header invalid","messagePattern":"X-Token header invalid","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"docs_src/dependencies/tutorial012_py310.py","lineNumber":6,"sourceCode":"from fastapi import Depends, FastAPI, Header, HTTPException\n\n\nasync def verify_token(x_token: str = Header()):\n    if x_token != \"fake-super-secret-token\":\n        raise HTTPException(status_code=400, detail=\"X-Token header invalid\")\n\n\nasync def verify_key(x_key: str = Header()):\n    if x_key != \"fake-super-secret-key\":\n        raise HTTPException(status_code=400, detail=\"X-Key header invalid\")\n    return x_key\n\n\napp = FastAPI(dependencies=[Depends(verify_token), Depends(verify_key)])\n\n\n@app.get(\"/items/\")\nasync def read_items():\n    return [{\"item\": \"Portal Gun\"}, {\"item\": \"Plumbus\"}]\n\n\n@app.get(\"/users/\")\nasync def read_users():","sourceCodeStart":1,"sourceCodeEnd":24,"githubUrl":"https://github.com/tiangolo/fastapi/blob/42a41db11f6882807ac3c057b942178d53b97438/docs_src/dependencies/tutorial012_py310.py#L1-L24","documentation":"Non-Annotated variant of error 28: `verify_token` (`x_token: str = Header()`) raises HTTP 400 \"X-Token header invalid\" when the X-Token header differs from \"fake-super-secret-token\". Registered as a global dependency, so it gates every route.","triggerScenarios":"Any request missing or mismatching the X-Token header on the tutorial012_py310 app.","commonSituations":"Header omitted; wrong value; case-sensitivity mistakes; secret rotation.","solutions":["Send `X-Token: fake-super-secret-token`.","Externalize the expected token to env/config.","Use 401 status for authentication failures.","Document required headers via OpenAPI security."],"exampleFix":"# before\nif x_token != \"fake-super-secret-token\":\n    raise HTTPException(status_code=400, detail=\"X-Token header invalid\")\n\n# after\nif x_token != settings.expected_token:\n    raise HTTPException(status_code=401, detail=\"Unauthorized\")","handlingStrategy":"validation","validationCode":"if not headers.get(\"X-Token\") or headers[\"X-Token\"] != EXPECTED_TOKEN:\n    raise PermissionError(\"missing/invalid X-Token\")","typeGuard":"def token_ok(headers: dict) -> bool:\n    return headers.get(\"X-Token\") == EXPECTED_TOKEN","tryCatchPattern":"r = client.get(\"/items/\", headers=headers)\nif r.status_code == 400 and r.json().get(\"detail\") == \"X-Token header invalid\":\n    ...","preventionTips":["Use a client interceptor to attach the header.","Externalize the token.","Prefer 401 over 400 for auth failures in your own design."],"tags":["fastapi","authentication","headers","global-dependency","http-400"],"analyzedSha":"42a41db11f6882807ac3c057b942178d53b97438","analyzedAt":"2026-08-04T19:23:32.007Z","schemaVersion":2}