Boxtech icon indicating copy to clipboard operation
Boxtech copied to clipboard

Invalid Authorization Header, must be encoded as such: `username:password` when password contains a colon

Open j-applese3d opened this issue 6 months ago • 1 comments

I'm having difficulty getting an access token via Swagger, or when trying the /oauth/token request with curl.

As I understand it, my username is my email. So the header should be:

-H 'Authorization: Basic [base64-encoded EMAIL:PASSWORD]'

so an example might be: (username: [email protected], password: test:ing:123)

-H 'Authorization: Basic bWVAZXhhbXBsZS5jb206dGVzdDppbmc6MTIz'

But the API will respond with:

{"message": "Invalid Authorization Header, must be encoded as such: `username:password`"}

Note: this is different from the typical "wrong password" response, which is: {"message": "Invalid grant: user credentials are invalid"}


Can this be fixed, and/or is there a way to change my password?

j-applese3d avatar Jul 24 '25 00:07 j-applese3d

I have found how to reset my password. So I made it something without a : and it works as expected now.

I would still suggest it to be a bug since : is a valid character when setting the password.

j-applese3d avatar Jul 24 '25 00:07 j-applese3d