dgraph-io/dgraph · error

invalid Bearer-formatted header value for JWT (%s)

Error message

invalid Bearer-formatted header value for JWT (%s)

What it means

In `AttachAuthorizationJwt`, Dgraph reads the incoming HTTP Authorization header and, if it starts with `bearer ` (case-insensitive), expects the header to contain exactly two space-separated parts: the literal "Bearer" and the token. Any other spacing/parts count fails with this message, which includes the offending header value.

Source

Thrown at graphql/authorization/auth.go:220

	return a.Header
}

// AttachAuthorizationJwt adds any incoming JWT authorization data into the grpc context metadata.
func (a *AuthMeta) AttachAuthorizationJwt(ctx context.Context,
	header http.Header) (context.Context, error) {
	if a == nil {
		return ctx, nil
	}

	authHeaderVal := header.Get(a.Header)
	if authHeaderVal == "" {
		return ctx, nil
	}

	if strings.HasPrefix(strings.ToLower(authHeaderVal), "bearer ") {
		parts := strings.Split(authHeaderVal, " ")
		if len(parts) != 2 {
			return ctx, fmt.Errorf("invalid Bearer-formatted header value for JWT (%s)",
				authHeaderVal)
		}
		authHeaderVal = parts[1]
	}

	md, ok := metadata.FromIncomingContext(ctx)
	if !ok {
		md = metadata.New(nil)
	}

	md.Append(string(AuthJwtCtxKey), authHeaderVal)
	ctx = metadata.NewIncomingContext(ctx, md)
	return ctx, nil
}

type CustomClaims struct {
	authMeta      *AuthMeta
	AuthVariables map[string]interface{}

View on GitHub (pinned to 759e242be6)

Solutions

1. Send the header as exactly `Authorization: Bearer <token>` with a single space and no extra whitespace
2. Trim the JWT and ensure it contains no internal spaces (JWTs are three dot-separated base64url segments)
3. Remove a duplicated Bearer prefix if your client library also adds one
4. Alternatively omit the Bearer prefix and send the raw token, which bypasses this parsing branch

Example fix

// before
curl -H 'Authorization: Bearer  eyJhbGciOi... ' /graphql
// after
curl -H 'Authorization: Bearer eyJhbGciOi...' /graphql

function setAuthHeader(token) {
  const t = String(token).trim();
  if (/\s/.test(t)) throw new Error('JWT must not contain whitespace');
  return { Authorization: `Bearer ${t}` };
}

const isBearerHeader = (v) => /^Bearer\s+\S+$/.test(v);

When it happens

Trigger: Sending an Authorization header with a Bearer prefix but extra spaces (e.g. "Bearer abc.def.ghi" with a double space produces 3 parts), or "Bearer" with no token, or a token value containing a space (e.g. newline-wrapped PEM-ish content pasted into the header).

Common situations: HTTP clients that collapse or duplicate whitespace; hand-built curl commands with a typo; token accidentally including a trailing space plus another value; frameworks that prepend "Bearer" while the code already included it.

Related errors

• expecting either JWKUrl or JWKUrls, both were given
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),
• required field missing in Dgraph.Authorization:%s
• audience value was expected but not provided
• JWT `aud` value doesn't match with the audience

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/d37439dcdd965b50. Report an issue: GitHub.