tursodatabase/turso · error · InvalidOperationException

Remote Turso URLs must not include embedded user information

Error message

Remote Turso URLs must not include embedded user information; use Auth Token instead.

What it means

GetRemoteUri() rejects remote URLs with embedded user information ('user:pass@host' or 'token@host'). The Turso .NET provider sends credentials exclusively through the Authorization Bearer header configured via the 'Auth Token' keyword, so userinfo in the URL is treated as a configuration mistake rather than being silently forwarded.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoConnectionOptions.cs:136

                "Remote Encryption Cipher and Remote Encryption Key must be specified together.");
        }

        return new TursoRemoteEncryptionOptions
        {
            Cipher = TursoRemoteEncryptionOptions.ParseCipher(cipher),
            Key = key,
        };
    }

    public Uri GetRemoteUri()
    {
        if (!Uri.TryCreate(DataSource, UriKind.Absolute, out var uri) || !IsRemoteScheme(uri.Scheme))
            throw new InvalidOperationException($"Data Source is not a remote Turso URL: {DataSource}");

        if (!string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))
            throw new InvalidOperationException("Remote Turso URLs must not include query strings or fragments.");
        if (!string.IsNullOrEmpty(uri.UserInfo))
            throw new InvalidOperationException("Remote Turso URLs must not include embedded user information; use Auth Token instead.");
        if (string.IsNullOrEmpty(uri.Host))
            throw new InvalidOperationException("Remote Turso URLs must include a host.");

        var scheme = uri.Scheme.ToLowerInvariant() switch
        {
            "libsql" => Tls == false ? "http" : "https",
            "turso" => ValidateTls(uri.Scheme, expectedTls: true, normalizedScheme: "https"),
            "http" => ValidateTls(uri.Scheme, expectedTls: false),
            "https" => ValidateTls(uri.Scheme, expectedTls: true),
            "ws" => ValidateTls(uri.Scheme, expectedTls: false, normalizedScheme: "http"),
            "wss" => ValidateTls(uri.Scheme, expectedTls: true, normalizedScheme: "https"),
            _ => throw new InvalidOperationException($"Unsupported remote Turso URL scheme: {uri.Scheme}")
        };

        var builder = new UriBuilder(uri)
        {
            Scheme = scheme,
            Port = uri.IsDefaultPort ? -1 : uri.Port,

View on GitHub (pinned to 6c72522679)

Solutions

1. Remove the userinfo portion from the URL, keeping only scheme://host/path.
2. Put the token in the 'Auth Token' connection keyword so it is sent as a Bearer header.
3. If the userinfo was a database username, delete it — Turso remote databases authenticate with a token only.

Example fix

// before
Data Source=https://eyJhbGciOiJ...@my-db-my-org.turso.io;

// after
Data Source=https://my-db-my-org.turso.io;Auth Token=eyJhbGciOiJ...;

if (Uri.TryCreate(dataSource, UriKind.Absolute, out var u) && !string.IsNullOrEmpty(u.UserInfo))
    throw new ConfigurationException("Move URL credentials to the 'Auth Token' keyword.");

try { await conn.OpenAsync(ct); } catch (InvalidOperationException ex) when (ex.Message.Contains("embedded user information")) { /* extract token from userinfo and switch to Auth Token keyword */ }

When it happens

Trigger: Data Source set to 'https://eyJhbGci...@db.turso.io' or 'https://user:password@db.turso.io' and then TursoConnection.Open() is called — any of libsql/http/https/ws/wss URLs with non-empty uri.UserInfo throw.

Common situations: Copying the 'https://<token>@<host>' URL form supported by other libsql clients or MySQL-style 'user:pass@host' connection URLs; secret managers that emit userinfo-style DSNs; tutorials mixing libsql SDK conventions.

Related errors

• Data Source is not a remote Turso URL: {DataSource}
• Remote Turso URLs must not include query strings or fragment
• Remote Turso URLs must include a host.
• Unsupported remote Turso URL scheme: {uri.Scheme}
• Embedded replica connections are not supported yet by the .N

AI-assisted analysis of tursodatabase/turso@6c72522679 (2026-08-20). Data as JSON: /api/errors/054eadbf813b8848. Report an issue: GitHub.