musistudio/claude-code-router · error · Error

Remote provider manifests cannot define sensitive Fetch usag

Error message

Remote provider manifests cannot define sensitive Fetch usage headers.

What it means

validateSafeHeaders rejects remote-managest connector Fetch usage headers named authorization, cookie, or proxy-authorization. A remote manifest must not be able to inject or override credential-carrying headers on requests made with the user's identity.

Source

Thrown at packages/core/src/providers/manifest-service.ts:319

    normalized === "::" ||
    normalized === "::1" ||
    normalized.startsWith("100:") ||
    normalized.startsWith("2001:2:") ||
    normalized.startsWith("2001:10:") ||
    normalized.startsWith("2001:db8:") ||
    normalized.startsWith("2002:") ||
    normalized.startsWith("fc") ||
    normalized.startsWith("fd") ||
    /^fe[89a-f]/.test(normalized) ||
    normalized.startsWith("ff")
  );
}

function validateSafeHeaders(headers: Record<string, string> | undefined): void {
  for (const key of Object.keys(headers ?? {})) {
    const normalized = key.trim().toLowerCase();
    if (normalized === "authorization" || normalized === "cookie" || normalized === "proxy-authorization") {
      throw new Error("Remote provider manifests cannot define sensitive Fetch usage headers.");
    }
  }
}

function isJsonContentType(value: string): boolean {
  return value === "application/json" || value.endsWith("+json");
}

function headerValue(value: string | string[] | number | undefined): string {
  if (Array.isArray(value)) {
    return value[0] ?? "";
  }
  return value === undefined ? "" : String(value);
}

View on GitHub (pinned to 99f24806c6)

Solutions

1. Delete the sensitive header from the manifest connector's usage headers
2. Rely on the platform's own auth injection (API key / OAuth config) instead of manifest-supplied headers
3. Rename genuinely non-sensitive custom headers (they are allowed as long as they are not the three blocked names)

Example fix

// before
"usage": { "headers": { "Authorization": "Bearer x" } }
// after
"usage": { "headers": { "X-Client": "my-app" } }

const SENSITIVE = new Set(['authorization','cookie','proxy-authorization']);
for (const k of Object.keys(headers ?? {})) if (SENSITIVE.has(k.trim().toLowerCase())) throw new Error('sensitive header');

When it happens

Trigger: validateRemoteAccountConnector() on a connector whose usage headers object contains any casing/whitespace variant of 'authorization', 'cookie', or 'proxy-authorization' (keys are trimmed and lowercased before comparison).

Common situations: Manifest author copies a working curl command including an Authorization header; connector config templates that set Cookie for session auth; attempts to forward proxy credentials.

Related errors

• ${issue.message}
• Provider manifest URL must use https.
• Provider manifest URL cannot include credentials.
• ${identityIssue.message}
• ${label} cannot include credentials.

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/9f066e7b669e9186. Report an issue: GitHub.