node-auth0: Bad HTTP authentication header format

setup:

const auth0ManagementClient = new ManagementClient({
  domain: auth0.account,
  token: auth0.clientId
});
const updateRes = await auth0ManagementClient.users.updateUserMetadata(params, metadata);

headers:

   { Authorization: 'Bearer w3mBrhiXGsZZZZZZZpAz2bS6VzLhOyJ',
     'User-agent': 'node.js/6.3.0',
     'Content-Type': 'application/json' }

stack trace:

at Client.request (/Users/mk/Code/action2/node_modules/rest-facade/src/Client.js:250:17)
      at Client.patch (/Users/mk/Code/action2/node_modules/rest-facade/src/Client.js:150:15)
      at UsersManager.updateUserMetadata (/Users/mk/Code/action2/node_modules/auth0/src/management/UsersManager.js:211:21)

response:

name: 'Bad Request',
message: 'Bad HTTP authentication header format',
statusCode: 400

About this issue

Original URL
State: closed
Created 8 years ago
Reactions: 5
Comments: 18 (1 by maintainers)

Most upvoted comments

For future travelers: I was getting this error because I had forgotten the audience property in the params when requesting the token. That successfully gave me a token but it failed with this error when I actually tried to use it.

mpj on Feb 4, 2017

I can’t believe it took me so long to notice the audience property on that access token request. Without it, you just get back a short access token. With it, you get a JWT-sized token. It would be nice if that was called. When upgrading, it’s easy to glance over that!

ps2goat on Jun 26, 2020

Hi! I’m sorry about the copy/paste message, but I’m cleaning up some stale/old issues. 🗑 It’s been a while since this issue was opened. Are you still having this issue with the latest version? If so, please reopen it with some repro steps so we can help!

luisrudge on Apr 16, 2018

If you go to the API docs while logged in with your account: https://auth0.com/docs/api/management/v2

In the top left there’s a control to choose the scopes for the token. Each time you add/remove a scope the token changes. Once I got the correct scopes set and used the generated token when initializing the client the operations succeeded.

onceknown on Aug 4, 2016