github/github-mcp-server · error · mark.ErrBadRequest

%w: Authorization header is badly formatted

Error message

%w: Authorization header is badly formatted

What it means

utils.ParseAuthorizationHeader found a header but the token - after optionally stripping 'Bearer ' (case-insensitive) - matches no supported GitHub format: none of the prefixes ghp_, github_pat_, gho_, ghu_, ghs_, and not the pre-2021 40-character lowercase-hex pattern (oldPatternRegexp). The middleware renders it as 400 'bad request: Authorization header is badly formatted'.

Source

Thrown at pkg/utils/token.go:34

	TokenTypeUnknown TokenType = iota
	TokenTypePersonalAccessToken
	TokenTypeFineGrainedPersonalAccessToken
	TokenTypeOAuthAccessToken
	TokenTypeUserToServerGitHubAppToken
	TokenTypeServerToServerGitHubAppToken
)

var supportedGitHubPrefixes = map[string]TokenType{
	"ghp_":        TokenTypePersonalAccessToken,            // Personal access token (classic)
	"github_pat_": TokenTypeFineGrainedPersonalAccessToken, // Fine-grained personal access token
	"gho_":        TokenTypeOAuthAccessToken,               // OAuth access token
	"ghu_":        TokenTypeUserToServerGitHubAppToken,     // User access token for a GitHub App
	"ghs_":        TokenTypeServerToServerGitHubAppToken,   // Installation access token for a GitHub App (a.k.a. server-to-server token)
}

var (
	ErrMissingAuthorizationHeader     = fmt.Errorf("%w: missing required Authorization header", mark.ErrBadRequest)
	ErrBadAuthorizationHeader         = fmt.Errorf("%w: Authorization header is badly formatted", mark.ErrBadRequest)
	ErrUnsupportedAuthorizationHeader = fmt.Errorf("%w: unsupported Authorization header", mark.ErrBadRequest)
)

// oldPatternRegexp is the regular expression for the old pattern of the token.
// Until 2021, GitHub API tokens did not have an identifiable prefix. They
// were 40 characters long and only contained the characters a-f and 0-9.
var oldPatternRegexp = regexp.MustCompile(`\A[a-f0-9]{40}\z`)

// ParseAuthorizationHeader parses the Authorization header from the HTTP request
func ParseAuthorizationHeader(req *http.Request) (tokenType TokenType, token string, _ error) {
	authHeader := req.Header.Get(httpheaders.AuthorizationHeader)
	if authHeader == "" {
		return 0, "", ErrMissingAuthorizationHeader
	}

	switch {
	// decrypt dotcom token and set it as token
	case strings.HasPrefix(authHeader, "GitHub-Bearer "):

View on GitHub (pinned to 0ea1f775a7)

Solutions

1. Use a real GitHub token of a supported type: classic PAT (ghp_), fine-grained PAT (github_pat_), OAuth token (gho_), or GitHub App user/installation token (ghu_/ghs_)
2. Check for copy errors - prefixes are case-sensitive and a mangled 'Ghp_' or truncated token fails
3. For legacy 40-hex tokens confirm all 40 lowercase hex characters survived copying

Example fix

# before
Authorization: Bearer my-secret-token

# after
Authorization: Bearer ghp_16C7e42F292c6912E7710c838347Ae178B4a

var gitHubTokenRe = regexp.MustCompile(`^(ghp_|github_pat_|gho_|ghu_|ghs_)[A-Za-z0-9_]+$|^[a-f0-9]{40}$`)

func looksLikeGitHubToken(t string) bool { return gitHubTokenRe.MatchString(t) }

if !looksLikeGitHubToken(token) {
	return errors.New("refusing to send: not a recognizable GitHub token format")
}

func isBadAuthHeader(err error) bool {
	return errors.Is(err, utils.ErrBadAuthorizationHeader)
}

if _, _, err := utils.ParseAuthorizationHeader(req); err != nil {
	if errors.Is(err, utils.ErrBadAuthorizationHeader) {
		// token format unrecognized: return 400 and tell the client to supply a real GitHub token
	}
}

When it happens

Trigger: Sending Authorization: Bearer my-token-123, a JWT, an unexpanded ${VAR} placeholder, another provider's token, or an empty value after 'Bearer ' - anything without a recognizable GitHub prefix.

Common situations: Copy-pasted example tokens never replaced; the wrong secret selected from a vault (AWS/OpenAI/GitLab key); hand-rolled test doubles issuing fake tokens; env interpolation failing so the literal placeholder is sent.

Related errors

• bad request: Authorization header is badly formatted
• bad request: unsupported Authorization header
• App not connected
• bad request
• %w: missing required Authorization header

AI-assisted analysis of github/github-mcp-server@0ea1f775a7 (2026-08-15). Data as JSON: /api/errors/288f5924539b2ff8. Report an issue: GitHub.