{"id":"679d3df39de61279","repo":"tiangolo/fastapi","slug":"x-token-header-invalid","errorCode":null,"errorMessage":"X-Token header invalid","messagePattern":"X-Token header invalid","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"docs_src/bigger_applications/app_an_py310/dependencies.py","lineNumber":8,"sourceCode":"from typing import Annotated\n\nfrom fastapi import Header, HTTPException\n\n\nasync def get_token_header(x_token: Annotated[str, Header()]):\n    if x_token != \"fake-super-secret-token\":\n        raise HTTPException(status_code=400, detail=\"X-Token header invalid\")\n\n\nasync def get_query_token(token: str):\n    if token != \"jessica\":\n        raise HTTPException(status_code=400, detail=\"No Jessica token provided\")\n","sourceCodeStart":1,"sourceCodeEnd":14,"githubUrl":"https://github.com/tiangolo/fastapi/blob/42a41db11f6882807ac3c057b942178d53b97438/docs_src/bigger_applications/app_an_py310/dependencies.py#L1-L14","documentation":"Raised inside the get_token_header dependency used by the bigger-applications items router. It compares the X-Token header to \"fake-super-secret-token\" and raises HTTP 400 if they differ. Because the dependency is attached at router level (dependencies=[Depends(get_token_header)]), it runs before every route under /items, providing centralized auth for that router.","triggerScenarios":"Any request to /items/* without an X-Token header equal to \"fake-super-secret-token\" (GET /items/, GET /items/{id}, PUT /items/{id}).","commonSituations":"Calling the items API from a new client without the token; rotating the secret without updating clients; forgetting that the router-level dependency covers all sub-routes.","solutions":["Send X-Token: fake-super-secret-token on every /items/* request.","Verify the dependency is intended for your route (it applies router-wide).","Move the secret to env/config and keep clients in sync."],"exampleFix":"# before\nclient.get(\"/items/\")\n# after\nclient.get(\"/items/\", headers={\"X-Token\": \"fake-super-secret-token\"})","handlingStrategy":"validation","validationCode":"TOKEN = \"fake-super-secret-token\"\nheaders = {\"X-Token\": TOKEN}\nclient.get(\"/items/\", headers=headers)","typeGuard":"def has_router_token(h: dict) -> bool:\n    return h.get(\"X-Token\") == \"fake-super-secret-token\"","tryCatchPattern":null,"preventionTips":["Remember the dependency covers ALL /items/* routes.","Keep the secret in config shared by clients.","Rotate tokens in lockstep with clients."],"tags":["fastapi","authentication","dependencies","http-headers"],"analyzedSha":"42a41db11f6882807ac3c057b942178d53b97438","analyzedAt":"2026-08-04T19:23:32.007Z","schemaVersion":2}