FlowiseAI/Flowise · error · Error

Invalid credentials: provide either Bearer Token or Username

Error message

Invalid credentials: provide either Bearer Token or Username + Access Token

What it means

Thrown by Jira.init when neither a bearerToken nor the (username + accessToken) pair is present in the credential. Jira supports two auth schemes: Bearer (PAT, used for Server/DC, API v2) and Basic (email + API token, used for Cloud, API v3). The init logic checks bearerToken first, then username&&accessToken; if both branches fail, it cannot pick an authType or an API version, so it throws.

Source

Thrown at packages/components/nodes/tools/Jira/Jira.ts:411

    async init(nodeData: INodeData, _: string, options: ICommonObject): Promise<any> {
        let credentialData = await getCredentialData(nodeData.credential ?? '', options)
        const jiraHost = nodeData.inputs?.jiraHost as string

        if (!jiraHost) {
            throw new Error('No Jira host provided')
        }

        const bearerToken = getCredentialParam('bearerToken', credentialData, nodeData)
        const username = getCredentialParam('username', credentialData, nodeData)
        const accessToken = getCredentialParam('accessToken', credentialData, nodeData)

        let authType: 'basic' | 'bearer'
        if (bearerToken) {
            authType = 'bearer'
        } else if (username && accessToken) {
            authType = 'basic'
        } else {
            throw new Error('Invalid credentials: provide either Bearer Token or Username + Access Token')
        }

        // Read SSL certificate from tool inputs if provided
        let sslCertificate: string | undefined
        const caFileBase64 = nodeData.inputs?.caFile as string
        if (caFileBase64) {
            if (caFileBase64.startsWith('FILE-STORAGE::')) {
                let file = caFileBase64.replace('FILE-STORAGE::', '')
                file = file.replace('[', '').replace(']', '')
                const orgId = options.orgId
                const chatflowid = options.chatflowid
                const fileData = await getFileFromStorage(file, orgId, chatflowid)
                sslCertificate = fileData.toString()
            } else {
                const splitDataURI = caFileBase64.split(',')
                splitDataURI.pop()
                const bf = Buffer.from(splitDataURI.pop() || '', 'base64')
                sslCertificate = bf.toString('utf-8')

View on GitHub (pinned to abe4a8601a)

Solutions

For Jira Cloud: set username (account email) and accessToken (API token from atlassian.com) in the credential.
For Jira Server/DC: set bearerToken (a Personal Access Token created in Jira profile).
Verify the credential selected on the node is the Jira credential type, not a generic one.
Re-enter tokens after rotation; an empty/whitespace-only token fails the truthy check.

Example fix

// before — credential has only username
getCredentialParam('username') === 'me@acme.com', others empty
// after — Cloud credential
username: 'me@acme.com', accessToken: '<api-token-from-atlassian>'

Defensive patterns

Strategy: validation

Validate before calling

function assertJiraCredentials(cred: { bearerToken?: string; username?: string; accessToken?: string }) {
  const hasBearer = !!cred.bearerToken?.trim()
  const hasBasic = !!cred.username?.trim() && !!cred.accessToken?.trim()
  if (!hasBearer && !hasBasic) {
    throw new Error('Provide Bearer Token (Server/DC) OR username + accessToken (Cloud)')
  }
}

Type guard

type JiraCred = { bearerToken?: string; username?: string; accessToken?: string }
function isUsableJiraCred(c: JiraCred): c is JiraCred & { bearerToken: string } | JiraCred & { username: string; accessToken: string } {
  return !!c.bearerToken?.trim() || (!!c.username?.trim() && !!c.accessToken?.trim())
}

Prevention

Match credential type to product: Cloud → email + API token; Server/DC → PAT.
Re-enter tokens after rotation; whitespace-only values fail the truthy check.
Select a Jira credential type, not a generic HTTP credential.
Verify all three fields aren't empty before saving the credential.

When it happens

Trigger: The credential was created but all three fields (bearerToken, username, accessToken) are empty; only username was supplied without an accessToken; the credential selected in the node is the wrong one (e.g. a generic HTTP credential without Jira fields); the credential fields were renamed in a migration.

Common situations: Mixing Jira Cloud (needs email + API token) with a PAT-only credential, or vice versa; selecting an empty credential record; token rotated in Jira but not updated in Flowise credential manager.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b8df98a0b9debd9b. Report an issue: GitHub.