tursodatabase/turso · error · InvalidOperationException

Auth Token requires an HTTPS remote Turso URL unless the hos

Error message

Auth Token requires an HTTPS remote Turso URL unless the host is localhost or loopback.

What it means

The client refuses to send your Bearer auth token over plaintext HTTP. ValidateAuthTokenTransport runs in the TursoRemoteClient constructor (reached from TursoConnection.Open) and again whenever the server redirects the session via base_url: if an AuthToken is configured, the endpoint must be https, or its host must be localhost/loopback. This is a credential-leak guard thrown as an InvalidOperationException, not a server-side failure.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoRemoteClient.cs:190

    {
        if (commandTimeout <= 0)
            return null;

        var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
        timeout.CancelAfter(TimeSpan.FromSeconds(commandTimeout));
        return timeout;
    }

    private static void ValidateAuthTokenTransport(Uri endpoint, string? authToken)
    {
        if (authToken is null
            || endpoint.Scheme.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase)
            || endpoint.IsLoopback)
        {
            return;
        }

        throw new InvalidOperationException("Auth Token requires an HTTPS remote Turso URL unless the host is localhost or loopback.");
    }

    private static RemoteStatement BuildStatement(string sql, TursoParameterCollection parameters, bool wantRows)
    {
        var statement = new RemoteStatement
        {
            Sql = sql,
            WantRows = wantRows,
        };

        foreach (TursoParameter parameter in parameters)
        {
            var value = RemoteRequestValue.FromTursoValue(parameter.ToValue());
            if (string.IsNullOrEmpty(parameter.ParameterName))
            {
                statement.Args.Add(value);
            }
            else

View on GitHub (pinned to 6c72522679)

Solutions

1. Change the Url in the connection string to https://.
2. If the target is genuinely local, use http://localhost or http://127.0.0.1 (loopback is exempt) or remove the AuthToken entirely.
3. If the error appeared mid-session rather than at Open, inspect what base_url the server or gateway returns and fix it to advertise https.
4. For self-hosted servers on a LAN, terminate TLS on a reverse proxy with a valid certificate instead of using plain HTTP.

Example fix

// before
var cs = "Url=http://192.168.1.50:8080;AuthToken=eyJhbGci...";

// after -- remote hosts need https; loopback or no-token needs nothing
var cs = "Url=https://db.mycompany.com;AuthToken=eyJhbGci...";
// or, for a local server without auth:
var cs = "Url=http://127.0.0.1:8080";

var opts = new TursoConnectionStringBuilder(cs);
var uri = new Uri(opts.Url);
if (!string.IsNullOrWhiteSpace(opts.AuthToken)
    && !uri.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase)
    && !uri.IsLoopback)
{
    throw new InvalidOperationException(
        $"Refusing to open: AuthToken over non-HTTPS {uri.Scheme}://{uri.Host}. Use https or a loopback host.");
}

static bool TokenTransportIsSafe(Uri url, string? authToken) =>
    string.IsNullOrEmpty(authToken)
    || url.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase)
    || url.IsLoopback;

try
{
    await conn.OpenAsync(cancellationToken);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("HTTPS remote Turso URL"))
{
    // configuration error, never transient: surface a clear config failure, do not retry
    throw new ConfigurationException("Turso Url must be https:// when AuthToken is set (or use localhost/127.0.0.1).", ex);
}

When it happens

Trigger: Opening a connection whose string is like 'Url=http://db.example.com;AuthToken=eyJ...' via TursoConnection.Open/OpenAsync; also triggered mid-session when a pipeline response carries a base_url that points the client at a non-HTTPS, non-loopback host (UpdateSession re-validates the redirected URL).

Common situations: Local or containerized setups that use a LAN IP (10.x, 192.168.x), a docker service name, or a VM hostname with http:// plus a token -- Uri.IsLoopback only covers localhost and 127.0.0.1; copying a cloud token into an http test config; a load balancer advertising an http:// base_url in redirect responses.

Related errors

• Auth Token requires an HTTPS sync URL unless the host is loc
• Auth Token requires HTTPS sync requests unless the host is l
• Embedded replica connections are not supported yet by the .N
• Sync Interval requires embedded replica support, which is no
• Auth Token requires a remote Turso URL Data Source.

AI-assisted analysis of tursodatabase/turso@6c72522679 (2026-08-20). Data as JSON: /api/errors/685d5d18896fbe0f. Report an issue: GitHub.