musistudio/claude-code-router · error · Error

${label} cannot include credentials.

Error message

${label} cannot include credentials.

What it means

validatePublicHttpsUrl throws when a URL from a remote manifest embeds userinfo credentials (user:pass@host). Embedded credentials end up in logs and URLs and are not a supported auth mechanism for manifest endpoints.

Source

Thrown at packages/core/src/providers/manifest-service.ts:216

function validateProviderApiKeyTarget(provider: ProviderDeepLinkPayload, endpoint: string): void {
  const issue = providerEndpointCanReceiveProviderApiKey({
    apiKey: "manifest-provider-api-key",
    endpoint,
    providerName: provider.name,
    providerPresetId: findProviderPresetByBaseUrl(provider.baseUrl)?.id
  });
  if (issue) {
    throw new Error(issue.message);
  }
}

async function validatePublicHttpsUrl(value: string, label: string): Promise<void> {
  const url = new URL(providerUrlWithDefaultScheme(value));
  if (url.protocol !== "https:") {
    throw new Error(`${label} from a remote manifest must use https.`);
  }
  if (url.username || url.password) {
    throw new Error(`${label} cannot include credentials.`);
  }
  validateRemoteHostname(url.hostname, label);
  await resolveSafeAddress(url.hostname);
}

function validateRemoteHostname(hostname: string, label: string): void {
  const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
  if (!normalized) {
    throw new Error(`${label} is invalid.`);
  }
  if (
    normalized === "localhost" ||
    normalized.endsWith(".localhost") ||
    normalized.endsWith(".home") ||
    normalized.endsWith(".lan") ||
    normalized.endsWith(".local") ||
    normalized.endsWith(".internal")
  ) {

View on GitHub (pinned to 99f24806c6)

Solutions

1. Remove the user:pass@ segment from the URL
2. Pass credentials via the connector's configured auth mechanism (headers/oauth) instead of the URL
3. Rotate the credentials if they were committed in a shared manifest

Example fix

// before
"baseUrl": "https://alice:secret@api.example.com"
// after
"baseUrl": "https://api.example.com"

const u = new URL(provider.baseUrl);
if (u.username || u.password) throw new Error('URL must not embed credentials');

When it happens

Trigger: provider.baseUrl or a connector endpoint like 'https://user:pass@api.example.com' — the URL parser populates url.username or url.password and the check fires.

Common situations: Copy-pasting a dashboard URL that includes basic-auth userinfo; private-registry style URLs pasted into manifest config.

Related errors

• Artifact URL contains unsupported credentials or fragments.
• Artifact URL contains an invalid access token.
• Provider manifest URL must use https.
• Provider manifest URL cannot include credentials.
• ${identityIssue.message}

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/07378981ed625361. Report an issue: GitHub.