plandex-ai/plandex · error

invalid auth header

Error message

invalid auth header

What it means

GetAuthHeader parses the Authorization header and requires the 'Bearer ' prefix. If the header is present but does not start with 'Bearer ', this error is thrown because the scheme is unsupported and the token cannot be extracted.

Source

Thrown at app/server/handlers/auth_helpers.go:56

		cookie, err := r.Cookie("authToken")
		if err != nil {
			if err == http.ErrNoCookie {
				log.Println("no auth cookie")
				return nil, nil
			}
			return nil, fmt.Errorf("error retrieving auth cookie: %v", err)
		}
		// Use the token from the cookie as the fallback authorization header
		authHeader = cookie.Value
		log.Println("got auth header from cookie")
	}

	if authHeader == "" {
		return nil, nil
	}

	if !strings.HasPrefix(authHeader, "Bearer ") {
		return nil, fmt.Errorf("invalid auth header")
	}

	// strip off the "Bearer " prefix
	encoded := strings.TrimPrefix(authHeader, "Bearer ")

	// decode the base64-encoded credentials
	bytes, err := base64.URLEncoding.DecodeString(encoded)

	if err != nil {
		return nil, fmt.Errorf("error decoding auth token: %v", err)
	}

	// parse the credentials
	var parsed shared.AuthHeader
	err = json.Unmarshal(bytes, &parsed)

	if err != nil {
		return nil, fmt.Errorf("error parsing auth token: %v", err)

View on GitHub (pinned to e2d772072e)

Solutions

1. Send the header as 'Authorization: Bearer <token>' from the client
2. Fix the client/curl invocation to include the Bearer scheme
3. Check middleware/proxies that may rewrite or truncate the Authorization header
4. Note: an empty Authorization header is tolerated (returns nil,nil); only a malformed non-empty header throws
5. Update outdated client SDK versions that used a legacy auth scheme

Example fix

// before
req.Header.Set("Authorization", token)
// after
req.Header.Set("Authorization", "Bearer "+token)

// client side, before sending
auth := token
if !strings.HasPrefix(auth, "Bearer ") { auth = "Bearer " + auth }
req.Header.Set("Authorization", auth)

func hasBearerScheme(h http.Header) bool {
    return strings.HasPrefix(h.Get("Authorization"), "Bearer ")
}

authHeader, err := GetAuthHeader(r)
if err != nil {
    if err.Error() == "invalid auth header" { http.Error(w, "unsupported authorization scheme", http.StatusBadRequest); return }
    http.Error(w, err.Error(), http.StatusUnauthorized)
}

When it happens

Trigger: A request includes an Authorization header that is non-empty but lacks the 'Bearer ' prefix — e.g. 'Basic dXNlcjpwYXNz', a bare token without scheme, or a misspelled scheme like 'bearer' in some clients is fine only if lowercase handled; here any non-'Bearer ' prefix fails. Called via SetAuthCookieIfBrowser and execAuthenticate.

Common situations: API clients using Basic auth or custom schemes against this server, curl commands pasted without the 'Bearer ' prefix, proxies stripping or rewriting the header, or older client versions sending a different scheme.

Related errors

• error loading accounts: %v
• error signing in to new account: %v
• error selecting account: %v
• error prompting for sign in to new account: %v
• error setting auth header: auth not loaded

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/ea8b3601593406ec. Report an issue: GitHub.