401 - malformed bearer token

← Errors examples

What happenedCopy Anchor Link

The Authorization header arrived but does not have the expected Bearer token format. Missing prefixes, pasted punctuation or newlines can cause this.

Request that triggers itCopy Anchor Link

An Authorization header that's missing the Bearer prefix.

curl -X POST "https://$OC_HOST/v1/tenants/$OC_TENANT/sql" \
  -H "Authorization: not-a-real-bearer" \
  -H "Content-Type: application/json" \
  -d '{"sql": "SELECT id FROM shop.products LIMIT 1"}'

Read the responseCopy Anchor Link

{
  "error": "unauthorized",
  "message": "Authorization header must be 'Bearer <token>'",
  "retry": false
}

Fix the requestCopy Anchor Link

1. Use the literal prefix Bearer followed by one space and the token.
2. Check that the secret variable is populated without printing its value.
3. Remove accidental surrounding quotes or newlines.
4. Send the corrected header.

Keep in mind: The response marks this request as non-retryable until the header is corrected.

Common causesCopy Anchor Link

• Token sent without the Bearer prefix.
• Lowercase bearer from a snippet - the parser is case-sensitive on the scheme name.
• Smart-quote characters from a doc copy-paste (" vs ").
• Trailing whitespace or newline pulled in from a file read.
• Two tokens concatenated by accident (env var set twice).

ContinueCopy Anchor Link

See error handling and retries, or return to error examples.