musistudio/claude-code-router · error · Error

Provider manifest URL must use https.

Error message

Provider manifest URL must use https.

What it means

validateManifestUrl requires manifest URLs fetched via deep link to use https:. Because the manifest can carry credentials and is fetched automatically, plain http:// is rejected to prevent interception of the manifest content.

Source

Thrown at packages/core/src/contracts/deep-link.ts:481

    throw new Error(`${label} is too long.`);
  }
  return value;
}

function validateProviderBaseUrl(value: string): void {
  const url = new URL(providerUrlWithDefaultScheme(value));
  if (!["http:", "https:"].includes(url.protocol)) {
    throw new Error("Provider Base URL must use http or https.");
  }
  if (!url.hostname) {
    throw new Error("Provider Base URL is invalid.");
  }
}

function validateManifestUrl(value: string): void {
  const url = new URL(value);
  if (url.protocol !== "https:") {
    throw new Error("Provider manifest URL must use https.");
  }
  if (url.username || url.password) {
    throw new Error("Provider manifest URL cannot include credentials.");
  }
  if (!url.hostname) {
    throw new Error("Provider manifest URL is invalid.");
  }
}

function normalizeProviderProtocol(value: string | undefined): GatewayProviderProtocol | undefined {
  if (!value) {
    return undefined;
  }
  const protocol = value.trim();
  if (!providerProtocols.has(protocol as GatewayProviderProtocol)) {
    throw new Error(`Unsupported provider protocol: ${value}`);
  }
  return protocol as GatewayProviderProtocol;

View on GitHub (pinned to 99f24806c6)

Solutions

1. Serve the manifest over https (use a TLS proxy or hosting with certs); for local dev use a self-signed-cert https server or a tunnel (ngrok https)
2. Fix the typo http:// -> https:// in the link generator
3. Never point at plain-http endpoints in production links

Example fix

// before
ccr://provider/install?manifest=http%3A%2F%2Fexample.com%2Fm.json
// after
ccr://provider/install?manifest=https%3A%2F%2Fexample.com%2Fm.json

if (!manifestUrl.startsWith("https://")) return reject("manifest must be https");

const isHttpsManifestUrl = (u: string) => { try { return new URL(u).protocol === "https:"; } catch { return false; } };

try { parseProviderManifestDeepLinkPayload(url); } catch (e) { if (e instanceof Error && e.message === "Provider manifest URL must use https.") return upgradeToHttps(url); throw e; }

When it happens

Trigger: A ccr:// provider link with manifest=http://example.com/provider.json — protocol is not https: so it throws before credential/host checks.

Common situations: Local development with a local http manifest server; providers hosting manifests on non-TLS endpoints; typos dropping the 's'.

Related errors

• Provider manifest must be a JSON object.
• ${label} is too long.
• Provider manifest URL cannot include credentials.
• Provider manifest URL is invalid.
• Unsupported provider protocol: ${value}

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/7cec1038636a7a6f. Report an issue: GitHub.