tursodatabase/turso · error · InvalidOperationException

Auth Token requires an HTTPS sync URL unless the host is loc

Error message

Auth Token requires an HTTPS sync URL unless the host is localhost or loopback.

What it means

Validate refuses a configuration where an AuthToken is supplied but the normalized sync URL is plain HTTP and the host is not localhost/loopback. Sending an auth token in cleartext over the network to a non-local host would leak credentials, so the combination is disallowed.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoSyncDatabaseOptions.cs:163

            Scheme = scheme,
            Port = RemoteUri.IsDefaultPort ? -1 : RemoteUri.Port,
            UserName = string.Empty,
            Password = string.Empty,
        };
        return builder.Uri;
    }

    internal void Validate()
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(Path);
        ArgumentException.ThrowIfNullOrWhiteSpace(ClientName);

        var normalizedUri = GetNormalizedRemoteUri();
        if (!string.IsNullOrWhiteSpace(AuthToken)
            && normalizedUri.Scheme != Uri.UriSchemeHttps
            && !normalizedUri.IsLoopback)
        {
            throw new InvalidOperationException(
                "Auth Token requires an HTTPS sync URL unless the host is localhost or loopback.");
        }

        if (LongPollTimeout is { } timeout
            && (timeout < TimeSpan.FromMilliseconds(1) || timeout.TotalMilliseconds > int.MaxValue))
        {
            throw new ArgumentOutOfRangeException(
                nameof(LongPollTimeout),
                timeout,
                $"Long-poll timeout must be between 1 and {int.MaxValue} milliseconds.");
        }

        ValidateNativeSize(PushOperationsThreshold, nameof(PushOperationsThreshold));
        ValidateNativeSize(PullBytesThreshold, nameof(PullBytesThreshold));
        PartialSync?.Validate();

        if (PartialSync is not null && !BootstrapIfEmpty)
            throw new InvalidOperationException("Partial sync requires BootstrapIfEmpty=True.");

View on GitHub (pinned to c1e5928725)

Solutions

1. Change the remote URL to https:// (or turso:// / libsql:// which normalize to HTTPS).
2. If the server genuinely has no TLS, use it only on localhost/loopback or deploy TLS in front of it.
3. Remove the AuthToken if the endpoint intentionally requires no auth (not recommended for non-local hosts).

Example fix

// before
var opts = new TursoSyncDatabaseOptions(path, new Uri("http://sync.internal:8080")) { AuthToken = token };
// after
var opts = new TursoSyncDatabaseOptions(path, new Uri("https://sync.internal:8443")) { AuthToken = token };

static void EnsureTokenOverHttps(Uri remoteUri, string? authToken)
{
    if (string.IsNullOrWhiteSpace(authToken)) return;
    var scheme = remoteUri.Scheme.ToLowerInvariant();
    var isHttps = scheme is "https" or "turso" or "libsql";
    if (!isHttps && !remoteUri.IsLoopback)
        throw new InvalidOperationException("Refusing to send AuthToken over plain HTTP to a non-local host.");
}

static bool TokenTransportIsSafe(Uri u, string? token) =>
    string.IsNullOrWhiteSpace(token) || u.Scheme.ToLowerInvariant() is "https" or "turso" or "libsql" || u.IsLoopback;

try { var db = new TursoSyncDatabase(opts); }
catch (InvalidOperationException ex) when (ex.Message.Contains("HTTPS sync URL"))
{
    // switch scheme to https (or deploy TLS) before retrying
}

When it happens

Trigger: Creating a TursoSyncDatabase with options where AuthToken is set, RemoteUri uses scheme http (or turso/libsql never hit this since they normalize to https), and the normalized host is not loopback (e.g. http://192.168.1.10:8080) — TursoSyncDatabaseOptions.cs:159-165.

Common situations: Pointing at an on-prem sync server over LAN HTTP while still sending a token, migrating a localhost dev config (http://localhost) to a staging server without switching to HTTPS, forgetting that turso/libsql schemes are https but http:// is not.

Related errors

• Auth Token requires HTTPS sync requests unless the host is l
• Auth Token requires an HTTPS remote Turso URL unless the hos
• Refusing to send the sync auth token to an origin other than
• Use AuthToken instead of embedding credentials in the sync U
• Automatic sync is not supported for embedded replica connect

AI-assisted analysis of tursodatabase/turso@c1e5928725 (2026-08-31). Data as JSON: /api/errors/c72a954489cb34b3. Report an issue: GitHub.