tinyhumansai/openhuman · error · anyhow::Error

http_cred '{}': bearer token is empty

Error message

http_cred '{}': bearer token is empty

What it means

An HTTP credential using the Header scheme (or Basic) produced an empty bearer/header token when materialized to request headers. The credential's secret field is empty, so `to_header()` refuses to inject an empty Authorization value — a data-integrity guard on the stored credential, not a transport error.

Source

Thrown at src/openhuman/security/credentials/http_creds.rs:125

        let now = Utc::now();
        Self {
            name: name.into(),
            scheme: HttpCredentialScheme::Header,
            header_name: Some(header_name.into()),
            username: None,
            secret: value.into(),
            created_at: now,
            updated_at: now,
        }
    }

    /// The `(header_name, header_value)` pair to inject onto the outbound
    /// request. **The returned value contains the secret** — callers must merge
    /// it into the request server-side and must never log or echo it.
    pub fn to_header(&self) -> Result<(String, String)> {
        match self.scheme {
            HttpCredentialScheme::Bearer => {
                anyhow::ensure!(
                    !self.secret.trim().is_empty(),
                    "http_cred '{}': bearer token is empty",
                    self.name
                );
                Ok((
                    "Authorization".to_string(),
                    format!("Bearer {}", self.secret),
                ))
            }
            HttpCredentialScheme::Basic => {
                let username = self.username.as_deref().unwrap_or_default();
                let encoded = base64::engine::general_purpose::STANDARD
                    .encode(format!("{username}:{}", self.secret));
                Ok(("Authorization".to_string(), format!("Basic {encoded}")))
            }
            HttpCredentialScheme::Header => {
                let header_name = self
                    .header_name

View on GitHub (pinned to 7491200858)

Solutions

1. Re-create or update the http_cred with a non-empty token
2. Check how the credential was inserted — an empty secret should have been rejected upstream
3. Never log the secret while debugging; only check emptiness

When it happens

Trigger: Thrown at src/openhuman/security/credentials/http_creds.rs:125 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/c48b0f6d5bd3ac96. Report an issue: GitHub.