tiangolo/fastapi · error · HTTPException

X-Token header invalid

Error message

X-Token header invalid

What it means

Raised inside the get_token_header dependency used by the bigger-applications items router. It compares the X-Token header to "fake-super-secret-token" and raises HTTP 400 if they differ. Because the dependency is attached at router level (dependencies=[Depends(get_token_header)]), it runs before every route under /items, providing centralized auth for that router.

Source

Thrown at docs_src/bigger_applications/app_an_py310/dependencies.py:8

from typing import Annotated

from fastapi import Header, HTTPException


async def get_token_header(x_token: Annotated[str, Header()]):
    if x_token != "fake-super-secret-token":
        raise HTTPException(status_code=400, detail="X-Token header invalid")


async def get_query_token(token: str):
    if token != "jessica":
        raise HTTPException(status_code=400, detail="No Jessica token provided")

View on GitHub (pinned to 42a41db11f)

Solutions

1. Send X-Token: fake-super-secret-token on every /items/* request.
2. Verify the dependency is intended for your route (it applies router-wide).
3. Move the secret to env/config and keep clients in sync.

Example fix

# before
client.get("/items/")
# after
client.get("/items/", headers={"X-Token": "fake-super-secret-token"})

TOKEN = "fake-super-secret-token"
headers = {"X-Token": TOKEN}
client.get("/items/", headers=headers)

def has_router_token(h: dict) -> bool:
    return h.get("X-Token") == "fake-super-secret-token"

When it happens

Trigger: Any request to /items/* without an X-Token header equal to "fake-super-secret-token" (GET /items/, GET /items/{id}, PUT /items/{id}).

Common situations: Calling the items API from a new client without the token; rotating the secret without updating clients; forgetting that the router-level dependency covers all sub-routes.

Related errors

• X-Token header invalid
• X-Key header invalid
• X-Token header invalid
• X-Key header invalid
• Invalid X-Token header

AI-assisted analysis of tiangolo/fastapi@42a41db11f (2026-08-04). Data as JSON: /data/errors/679d3df39de61279.json. Report an issue: GitHub.