AlexxIT/go2rtc · error

unsupported auth

Error message

unsupported auth: ${auth}

What it means

tcp.Do auth-negotiation guard: the server replied 401 with credentials present, but the WWW-Authenticate header does not start with 'Digest' (raw header appended). Only Digest auth is implemented (Basic is deliberately unsupported here, except the Hikvision ISAPI workaround), so authentication cannot proceed.

Solutions

1. Enable Digest authentication on the camera instead of Basic
2. Remove credentials to try anonymous access if the device allows it
3. Proxy the device through something that terminates Basic auth

When it happens

Trigger: Thrown at pkg/tcp/request.go:91 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/767204d997132a52. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tcp/request.go:91

	user := req.URL.User

	// Hikvision won't answer on Basic auth with any headers
	if strings.HasPrefix(req.URL.Path, "/ISAPI/") {
		req.URL.User = nil
	}

	res, err := client.Do(req)
	if err != nil {
		return nil, err
	}

	if res.StatusCode == http.StatusUnauthorized && user != nil {
		Close(res)

		auth := res.Header.Get("WWW-Authenticate")
		if !strings.HasPrefix(auth, "Digest") {
			return nil, errors.New("unsupported auth: " + auth)
		}

		realm := Between(auth, `realm="`, `"`)
		nonce := Between(auth, `nonce="`, `"`)
		qop := Between(auth, `qop="`, `"`)

		username := user.Username()
		password, _ := user.Password()
		ha1 := HexMD5(username, realm, password)

		uri := req.URL.RequestURI()
		ha2 := HexMD5(req.Method, uri)

		var header string

		switch qop {
		case "":
			response := HexMD5(ha1, nonce, ha2)

View on GitHub (pinned to c245815e75)