phacility/phabricator · error · Exception

Request included a client_id parameter and an "Authorization

Error message

Request included a client_id parameter and an "Authorization" header with a username, but the values "%s" and "%s") disagree. The values must match.

What it means

Error "Request included a client_id parameter and an "Authorization" header with a username, but the values "%s" and "%s") disagree. The values must match." thrown in phacility/phabricator.

Source

Thrown at src/applications/oauthserver/controller/PhabricatorOAuthServerTokenController.php:28

  public function shouldAllowRestrictedParameter($parameter_name) {
    if ($parameter_name == 'code') {
      return true;
    }
    return parent::shouldAllowRestrictedParameter($parameter_name);
  }

  public function handleRequest(AphrontRequest $request) {
    $grant_type = $request->getStr('grant_type');
    $code = $request->getStr('code');
    $redirect_uri = $request->getStr('redirect_uri');
    $response = new PhabricatorOAuthResponse();
    $server = new PhabricatorOAuthServer();

    $client_id_parameter = $request->getStr('client_id');
    $client_id_header = idx($_SERVER, 'PHP_AUTH_USER');
    if (strlen($client_id_parameter) && strlen($client_id_header)) {
      if ($client_id_parameter !== $client_id_header) {
        throw new Exception(
          pht(
            'Request included a client_id parameter and an "Authorization" '.
            'header with a username, but the values "%s" and "%s") disagree. '.
            'The values must match.',
            $client_id_parameter,
            $client_id_header));
      }
    }

    $client_secret_parameter = $request->getStr('client_secret');
    $client_secret_header = idx($_SERVER, 'PHP_AUTH_PW');
    if (strlen($client_secret_parameter)) {
      // If the `client_secret` parameter is present, prefer parameters.
      $client_phid = $client_id_parameter;
      $client_secret = $client_secret_parameter;
    } else {
      // Otherwise, read values from the "Authorization" header.
      $client_phid = $client_id_header;

View on GitHub (pinned to 5720a38cfe)

When it happens

Trigger: Thrown at src/applications/oauthserver/controller/PhabricatorOAuthServerTokenController.php:28 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/464c6635e44fff24. Report an issue: GitHub.