wg-easy/wg-easy · error

Bearer Auth required

Error message

Bearer Auth required

What it means

Thrown when an Authorization header is present but is not a Bearer token (scheme other than 'Bearer' or empty value). HTTP 401 — metrics endpoints require Bearer authentication.

Source

Thrown at src/server/utils/handler.ts:161

  handler: MetricsHandler<TReq, TRes>
) => {
  return defineEventHandler(async (event) => {
    const metricsConfig = await Database.general.getMetricsConfig();

    if (metricsConfig.password) {
      const auth = getHeader(event, 'Authorization');

      if (!auth) {
        throw createError({
          statusCode: 401,
          statusMessage: 'Unauthorized',
        });
      }

      const [method, value] = auth.split(' ');

      if (method !== 'Bearer' || !value) {
        throw createError({
          statusCode: 401,
          statusMessage: 'Bearer Auth required',
        });
      }

      const tokenValid = await isPasswordValid(value, metricsConfig.password);

      if (!tokenValid) {
        throw createError({
          statusCode: 401,
          statusMessage: 'Incorrect token',
        });
      }
    }

    if (metricsConfig[type] !== true) {
      throw createError({
        statusCode: 400,

View on GitHub (pinned to 5c38c1427a)

Solutions

1. Use exactly `Authorization: Bearer <metrics-password>` (capital B, single space)
2. Change your client's auth scheme from Basic/custom to Bearer
3. Ensure the token value is non-empty after trimming
4. Verify the header is not encoded/mangled by an intermediate proxy

Example fix

// before
headers: { Authorization: metricsPassword }
// after
headers: { Authorization: `Bearer ${metricsPassword}` }

const auth = `Bearer ${token}`;
if (!/^Bearer \S+$/.test(auth)) throw new Error('Use Bearer scheme');

function isBearerHeader(v) { const [m, val] = (v ?? '').split(' '); return m === 'Bearer' && !!val; }

try {
  return await fetchMetrics();
} catch (e) {
  if (e.statusCode === 401 && e.statusMessage === 'Bearer Auth required') {
    // fix scheme: use 'Authorization: Bearer <token>'
  }
  throw e;
}

When it happens

Trigger: Sending `Authorization: Basic ...` or a bare token without the 'Bearer ' prefix to a password-protected metrics endpoint; a header like 'Bearer' with no token after it.

Common situations: Scrape tools sending Basic auth by default, misconfigured monitors using 'Token' or custom schemes, copying only the password without the Bearer prefix.

Related errors

• Unauthorized
• Incorrect token
• Invalid username or password
• User disabled
• Invalid password

AI-assisted analysis of wg-easy/wg-easy@5c38c1427a (2026-08-30). Data as JSON: /api/errors/72d547d4fd0e4380. Report an issue: GitHub.