plandex-ai/plandex · error

error setting auth header: auth not loaded

Error message

error setting auth header: auth not loaded

What it means

SetAuthHeader attaches a base64-encoded JSON auth header (token, org id, hash) to an outgoing HTTP request. It returns this error when the package-level `Current` *shared.ClientAuth is nil, i.e. no auth was ever loaded (MustResolveAuth never ran or auth.json is missing/failed to load). It is a fail-fast guard against sending unauthenticated requests.

Source

Thrown at app/cli/auth/api.go:22

	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"plandex-cli/types"
	"plandex-cli/version"

	shared "plandex-shared"
)

var apiClient types.ApiClient

func SetApiClient(client types.ApiClient) {
	apiClient = client
}

func SetAuthHeader(req *http.Request) error {
	if Current == nil {
		return fmt.Errorf("error setting auth header: auth not loaded")
	}
	hash := Current.ToHash()

	authHeader := shared.AuthHeader{
		Token: Current.Token,
		OrgId: Current.OrgId,
		Hash:  hash,
	}

	bytes, err := json.Marshal(authHeader)

	if err != nil {
		return fmt.Errorf("error marshalling auth header: %v", err)
	}

	// base64 encode
	token := base64.URLEncoding.EncodeToString(bytes)

View on GitHub (pinned to e2d772072e)

Solutions

1. Run the CLI's sign-in flow (e.g. `plandex sign in`) so auth.json is created and `Current` is set
2. Ensure auth.MustResolveAuth (or equivalent initialization) is called before any API request
3. Check that fs.HomeAuthPath exists and is readable (correct HOME, permissions)
4. If embedding the client, call auth.SetApiClient and complete auth resolution before issuing requests

Example fix

// before
client.Do(req) // -> error setting auth header: auth not loaded
// after
if auth.Current == nil {
	term.OutputErrorAndExit("Not signed in — run `plandex sign in` first")
}
client.Do(req)

if auth.Current == nil {
	return fmt.Errorf("not signed in: run `plandex sign in` before issuing API requests")
}

func authLoaded() bool { return auth.Current != nil }

if err := auth.SetAuthHeader(req); err != nil {
	if strings.Contains(err.Error(), "auth not loaded") {
		// fall back to interactive sign-in then retry
		auth.MustResolveAuth(true)
		return auth.SetAuthHeader(req)
	}
	return err
}

When it happens

Trigger: RoundTrip invokes SetAuthHeader before any call to auth.MustResolveAuth/initial sign-in has populated `Current`; auth.json does not exist at fs.HomeAuthPath; or a previous unmarshal failure left Current nil.

Common situations: Users running the CLI before `plandex sign in`; a wiped or unreadable HOME directory so auth.json is missing; a corrupted auth.json that failed to unmarshal earlier in the startup path; embedding code that calls the API client directly without initializing auth.

Related errors

• invalid auth header
• error getting auth header
• no auth header
• User does not have permission to invite user with role:
• error loading accounts: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/1c7159625b85f437. Report an issue: GitHub.