musistudio/claude-code-router · error · Error

Provider manifest URL cannot include credentials.

Error message

Provider manifest URL cannot include credentials.

What it means

validateManifestUrl rejects manifest URLs containing userinfo (url.username or url.password), e.g. https://user:pass@example.com/m.json. Credentials embedded in the URL would leak into logs and the deep link itself, so they are explicitly forbidden.

Source

Thrown at packages/core/src/contracts/deep-link.ts:484

}

function validateProviderBaseUrl(value: string): void {
  const url = new URL(providerUrlWithDefaultScheme(value));
  if (!["http:", "https:"].includes(url.protocol)) {
    throw new Error("Provider Base URL must use http or https.");
  }
  if (!url.hostname) {
    throw new Error("Provider Base URL is invalid.");
  }
}

function validateManifestUrl(value: string): void {
  const url = new URL(value);
  if (url.protocol !== "https:") {
    throw new Error("Provider manifest URL must use https.");
  }
  if (url.username || url.password) {
    throw new Error("Provider manifest URL cannot include credentials.");
  }
  if (!url.hostname) {
    throw new Error("Provider manifest URL is invalid.");
  }
}

function normalizeProviderProtocol(value: string | undefined): GatewayProviderProtocol | undefined {
  if (!value) {
    return undefined;
  }
  const protocol = value.trim();
  if (!providerProtocols.has(protocol as GatewayProviderProtocol)) {
    throw new Error(`Unsupported provider protocol: ${value}`);
  }
  return protocol as GatewayProviderProtocol;
}

function readDeepLinkModels(params: URLSearchParams, payload: Record<string, unknown> | undefined): string[] {

View on GitHub (pinned to 99f24806c6)

Solutions

1. Remove credentials from the URL; use a pre-signed https URL without userinfo if auth is needed
2. Move the manifest to a public (or token-in-path) endpoint that needs no userinfo
3. Strip url.username/url.password when sanitizing user-supplied URLs

Example fix

// before
https://user:pass@example.com/m.json
// after
https://example.com/m.json?token=pre-signed-token

const u = new URL(manifestUrl); if (u.username || u.password) manifestUrl = u.origin + u.pathname + u.search; // strip userinfo

const urlHasNoCredentials = (u: string) => { try { const p = new URL(u); return !p.username && !p.password; } catch { return false; } };

try { validateManifestUrl(url); } catch (e) { if (e instanceof Error && e.message.includes("cannot include credentials")) return stripUserinfoAndRetry(url); throw e; }

When it happens

Trigger: Passing a manifest URL with embedded basic-auth credentials in the ccr:// deep link's manifest param.

Common situations: Copying an authenticated URL from a browser devtools/network tab; private registries that put tokens in the URL; shareable links accidentally containing personal tokens.

Related errors

• Provider manifest URL must use https.
• ${identityIssue.message}
• ${issue.message}
• ${label} cannot include credentials.
• ${label} cannot target a local or internal host.

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/03d2ec8eed77eab5. Report an issue: GitHub.