langgenius/dify · error · Unauthorized

Authorization header is missing.

Error message

Authorization header is missing.

What it means

werkzeug Unauthorized (HTTP 401) from admin_required: extract_access_token(request) returned no token, meaning the request lacked a usable Authorization header. The guard requires a Bearer-style token carrying the configured ADMIN_API_KEY. Raised before the key is ever compared, so it is purely a missing-header condition.

Source

Thrown at api/controllers/console/admin.py:19

from collections.abc import Callable
from functools import wraps

from flask import request
from werkzeug.exceptions import Unauthorized

from configs import dify_config
from libs.token import extract_access_token


def admin_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:
    @wraps(view)
    def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
        if not dify_config.ADMIN_API_KEY:
            raise Unauthorized("API key is invalid.")

        auth_token = extract_access_token(request)
        if not auth_token:
            raise Unauthorized("Authorization header is missing.")
        if auth_token != dify_config.ADMIN_API_KEY:
            raise Unauthorized("API key is invalid.")

        return view(*args, **kwargs)

    return decorated

View on GitHub (pinned to ef8544b173)

Solutions

  1. Send Authorization: Bearer <ADMIN_API_KEY> on the request.
  2. If using a different token scheme, switch to the Bearer scheme that extract_access_token expects.
  3. Update the calling script to always attach the header from the configured ADMIN_API_KEY.
  4. Verify the header is not stripped by a proxy/gateway in front of the API.

Example fix

# before
curl https://host/console/admin/<route>
# after
curl -H "Authorization: Bearer $ADMIN_API_KEY" https://host/console/admin/<route>
Defensive patterns

Strategy: validation

Validate before calling

def build_admin_headers(api_key: str) -> dict[str, str]:
    if not api_key:
        raise ValueError('ADMIN_API_KEY is required')
    return {'Authorization': f'Bearer {api_key}'}

Try / catch

from werkzeug.exceptions import Unauthorized

try:
    resp = client.get(admin_url, headers={'Authorization': f'Bearer {key}'})
except Unauthorized as exc:
    if 'missing' in str(exc).lower():
        attach_authorization_header()
    raise

Prevention

When it happens

Trigger: Calling an @admin_required endpoint with no Authorization header, an empty one, or a header in a scheme extract_access_token does not accept. Reproducible: curl https://host/console/admin/... with no -H Authorization.

Common situations: Operator forgot to pass the admin key on a one-off curl; a monitoring/probe script that hits the admin endpoint without auth headers; client that sends the key in a query param or custom header instead of the expected Authorization scheme.

Related errors

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/4e7bb2aab001460c. Report an issue: GitHub.