[FIX] report_carbon : Remove Authorization header when using a self-hosted Carbone CE instance

report_carbone/models/base/ir_actions_report.py

@@ -547,6 +547,10 @@ class IrActionsReportCarbone(models.Model):
             .get_param("report-engine.carbone_studio_url")
         )
         csdk.set_api_url(api_url)
+        # Carbone CE (self-hosted, securityLevel=0) does not require authentication.
+        # Sending a Bearer token causes a JWT validation error server-side.
+        if api_url and api_url != "https://api.carbone.io":
+            csdk._api_headers.pop("Authorization", None)
         return csdk
 
     def _get_json_data(self, export_json_instance, field_names, record, model, lang_codes):