tiangolo/fastapi · error · HTTPException

X-Key header invalid

Error message

X-Key header invalid

What it means

Non-Annotated variant of error 15: verify_key raises HTTP 400 when X-Key != "fake-super-secret-key". Same stacked-dependency guard as the Annotated version.

Source

Thrown at docs_src/dependencies/tutorial006_py310.py:13

from fastapi import Depends, FastAPI, Header, HTTPException

app = FastAPI()


async def verify_token(x_token: str = Header()):
    if x_token != "fake-super-secret-token":
        raise HTTPException(status_code=400, detail="X-Token header invalid")


async def verify_key(x_key: str = Header()):
    if x_key != "fake-super-secret-key":
        raise HTTPException(status_code=400, detail="X-Key header invalid")
    return x_key


@app.get("/items/", dependencies=[Depends(verify_token), Depends(verify_key)])
async def read_items():
    return [{"item": "Foo"}, {"item": "Bar"}]

View on GitHub (pinned to 42a41db11f)

Solutions

  1. Send X-Key: fake-super-secret-key alongside X-Token.
  2. Use a shared headers dict for all calls.
  3. Verify both dependencies pass.

Example fix

# before
headers={"X-Token":"fake-super-secret-token"}
# after
headers={"X-Token":"fake-super-secret-token","X-Key":"fake-super-secret-key"}
Defensive patterns

Strategy: validation

Validate before calling

headers = {"X-Token": "fake-super-secret-token", "X-Key": "fake-super-secret-key"}
client.get("/items/", headers=headers)

Type guard

def has_both_headers(h: dict) -> bool:
    return h.get("X-Token") == "fake-super-secret-token" and h.get("X-Key") == "fake-super-secret-key"

Prevention

When it happens

Trigger: GET /items/ with X-Token correct but X-Key missing/wrong.

Common situations: Client sets only the token header; one header dropped by infrastructure.

Related errors

AI-assisted analysis of tiangolo/fastapi@42a41db11f (2026-08-04). Data as JSON: /data/errors/506fb6c7711b1170.json. Report an issue: GitHub.