%s "%s" value must not be empty and only contain ascii chara

Error message

%s "%s" value must not be empty and only contain ascii characters

What it means

Each value in the http backend 'headers' map must be a non-empty (after strings.TrimSpace) pure-ASCII string; the regex [^[:ascii:]] rejects any character above 0x7F. Validation runs at schema-check time, before any request, because the map is written into outgoing HTTP requests verbatim.

Source

Thrown at internal/backend/remote-state/http/backend.go:142

			"headers": &schema.Schema{
				Type:     schema.TypeMap,
				Elem:     &schema.Schema{Type: schema.TypeString},
				Optional: true,
				ValidateFunc: func(cv interface{}, ck string) ([]string, []error) {
					nameRegex := regexp.MustCompile("[^a-zA-Z0-9-_]")
					valueRegex := regexp.MustCompile("[^[:ascii:]]")

					headers := cv.(map[string]interface{})
					err := make([]error, 0, len(headers))
					for name, value := range headers {
						if len(name) == 0 || nameRegex.MatchString(name) {
							err = append(err, fmt.Errorf(
								"%s \"%s\" name must not be empty and only contain A-Za-z0-9-_ characters", ck, name))
						}

						v := value.(string)
						if len(strings.TrimSpace(v)) == 0 || valueRegex.MatchString(v) {
							err = append(err, fmt.Errorf(
								"%s \"%s\" value must not be empty and only contain ascii characters", ck, name))
						}
					}
					return nil, err
				},
				Description: "A map of headers, when set will be included with HTTP requests sent to the HTTP backend",
			},
		},
	}

	b := &Backend{Backend: s, encryption: enc}
	b.Backend.ConfigureFunc = b.configure
	return b
}

type Backend struct {
	*schema.Backend
	encryption encryption.StateEncryption

View on GitHub (pinned to 3561785c48)

Solutions

Set a non-empty, ASCII-only value for the header named in the error message
Re-type quotes and dashes manually after pasting values from documentation or chat
If a header is optional, remove the entry entirely instead of leaving it empty

Example fix

# before
headers = {
  "X-Api-Key" = "käy-123"
}
# after
headers = {
  "X-Api-Key" = "kay-123"
}

Defensive patterns

Strategy: validation

Validate before calling

// Validate header values before writing them into the backend config
func validHeaderValues(headers map[string]string) bool {
    for _, v := range headers {
        if strings.TrimSpace(v) == "" {
            return false
        }
        for _, r := range v {
            if r > 127 {
                return false
            }
        }
    }
    return true
}

Prevention

Type header values by hand after copying tokens from chat clients or docs
Strip BOMs and newlines when injecting secret values from env files or vaults
Omit optional headers instead of setting them to empty strings

When it happens

Trigger: headers = { "X-Token" = "" }, a value that is only whitespace, or values containing non-ASCII characters such as "pässwort", smart quotes, em-dashes, or emoji.

Common situations: Copy-pasting tokens from rich-text docs, wikis, or chat clients that silently introduce unicode quotes/dashes; templating secrets where the template renders empty or includes a BOM; i18n characters in default values.

Related errors

AI-assisted analysis of opentofu/opentofu@3561785c48 (2026-08-15). Data as JSON: /api/errors/9909188f7bdece42. Report an issue: GitHub.