iflytek/astron-agent · error · GatewayAuthException

malformed bearer credential

Error message

malformed bearer credential

What it means

After stripping the Bearer prefix, authenticateWorkflow expects the credential to be exactly two non-empty segments joined by ':' (appKey:appSecret). Any credential that splits into more or fewer parts, or has an empty segment, throws GatewayAuthException("malformed bearer credential").

Solutions

1. Send the credential as exactly 'Bearer <appKey>:<appSecret>' with one colon and both parts non-empty.
2. Do not URL-encode the colon inside the Bearer token.
3. Confirm the credential was not truncated or wrapped (quotes/newlines) by the client config.

Example fix

// before
Authorization: Bearer myAppKey
// after
Authorization: Bearer myAppKey:myAppSecret

const cred = authHeader.slice('Bearer '.length); if (!/^[^:]+:[^:]+$/.test(cred)) { throw new Error('credential must be appKey:appSecret'); }

function isWellFormedCredential(h) { const parts = (h || '').replace(/^Bearer\s+/, '').split(':'); return parts.length === 2 && parts[0] && parts[1]; }

When it happens

Trigger: Sending 'Authorization: Bearer onlyKey' (no colon), 'Bearer a:b:c' (extra colon), 'Bearer :secret' or 'Bearer key:' (empty segment), or a token containing whitespace/encoded characters that break the split.","commonSituations

Common situations: Developers pasting a raw appKey without the secret; URL-encoding the colon (%3A); putting the whole JSON credential object into the header; config templates with placeholder colons left unresolved.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• CodeEnum.PARAM_ERROR
• missing bearer credential
• APP_TENANT_NOT_FOUND_ERROR
• artifact_upload_failed
• Cannot find appid authentication information

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/96cd873d04a0e8e2. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/GatewayAuthServiceImpl.java:29

    private static final String BEARER_PREFIX = "Bearer ";

    private final TenantGatewayAuthClient tenantClient;

    public GatewayAuthServiceImpl(TenantGatewayAuthClient tenantClient) {
        this.tenantClient = tenantClient;
    }

    @Override
    public String authenticateWorkflow(String authorizationHeader) {
        if (!StringUtils.hasText(authorizationHeader) || !authorizationHeader.startsWith(BEARER_PREFIX)) {
            throw new GatewayAuthException("missing bearer credential");
        }

        String credential = authorizationHeader.substring(BEARER_PREFIX.length()).trim();
        String[] parts = credential.split(":", -1);
        if (parts.length != 2 || !StringUtils.hasText(parts[0]) || !StringUtils.hasText(parts[1])) {
            throw new GatewayAuthException("malformed bearer credential");
        }

        return tenantClient.verify(parts[0], parts[1])
                .filter(StringUtils::hasText)
                .orElseThrow(() -> new GatewayAuthException("invalid app credential"));
    }
}

View on GitHub (pinned to 5e758547a8)