iflytek/astron-agent · error · GatewayAuthException

missing bearer credential

Error message

missing bearer credential

What it means

GatewayAuthServiceImpl.authenticateWorkflow validates the Authorization header of workflow gateway requests. When the header is absent, empty, or does not start with the configured Bearer prefix, the service immediately rejects the request with GatewayAuthException("missing bearer credential"). It is the first gate of app-credential authentication before the tenant client verifies the credential.

Solutions

1. Add the header 'Authorization: Bearer appKey:appSecret' (the credential format this service expects) to the request.
2. Verify the client/http layer is not stripping the Authorization header (proxies, gateway rewrites).
3. Check for scheme typos — it must be exactly the Bearer prefix the service defines (case-sensitive startsWith).

Example fix

// before
curl -X POST https://gateway/api/workflow/run -d '{...}'
// after
curl -X POST https://gateway/api/workflow/run -H 'Authorization: Bearer myAppKey:myAppSecret' -d '{...}'

if (!authHeader || !authHeader.startsWith('Bearer ')) { throw new Error('attach Authorization: Bearer <appKey>:<appSecret>'); }

function hasBearer(h) { return typeof h === 'string' && h.startsWith('Bearer '); }

When it happens

Trigger: Calling a workflow gateway endpoint without an Authorization header, sending an empty header, or using a scheme other than 'Bearer <credential>' (e.g. raw token, 'Basic', lowercase/other scheme names that fail the BEARER_PREFIX check).

Common situations: Clients forgetting to attach the auth header after removing an interceptor; reverse proxies stripping Authorization headers; scripts calling the gateway with curl but omitting -H; misconfigured SDK base clients without default headers.

Related errors

• CodeEnum.PARAM_ERROR
• malformed bearer credential
• APP_TENANT_NOT_FOUND_ERROR
• artifact_upload_failed
• Cannot find appid authentication information

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/068c47249d4747d7. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/GatewayAuthServiceImpl.java:23

import com.iflytek.astron.console.hub.service.gateway.TenantGatewayAuthClient;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;

@Service
public class GatewayAuthServiceImpl implements GatewayAuthService {

    private static final String BEARER_PREFIX = "Bearer ";

    private final TenantGatewayAuthClient tenantClient;

    public GatewayAuthServiceImpl(TenantGatewayAuthClient tenantClient) {
        this.tenantClient = tenantClient;
    }

    @Override
    public String authenticateWorkflow(String authorizationHeader) {
        if (!StringUtils.hasText(authorizationHeader) || !authorizationHeader.startsWith(BEARER_PREFIX)) {
            throw new GatewayAuthException("missing bearer credential");
        }

        String credential = authorizationHeader.substring(BEARER_PREFIX.length()).trim();
        String[] parts = credential.split(":", -1);
        if (parts.length != 2 || !StringUtils.hasText(parts[0]) || !StringUtils.hasText(parts[1])) {
            throw new GatewayAuthException("malformed bearer credential");
        }

        return tenantClient.verify(parts[0], parts[1])
                .filter(StringUtils::hasText)
                .orElseThrow(() -> new GatewayAuthException("invalid app credential"));
    }
}

View on GitHub (pinned to 5e758547a8)