cannot simultaneously use `authorization`, `basic_auth, `bea

Error message

cannot simultaneously use `authorization`, `basic_auth, `bearer_token` and `oauth2`

What it means

Guard in promauth.Config.NewConfig: the oauth2 block is present but getAuthHeader was already set by authorization, basic_auth, or bearer_token, so more than one exclusive auth mechanism is active; the sentinel fires at config-parse time.

Source

Thrown at lib/promauth/config.go:735

	}
	if opts.BearerTokenFile != "" {
		if actx.getAuthHeader != nil {
			return nil, fmt.Errorf("cannot simultaneously use `authorization`, `basic_auth` and `bearer_token_file`")
		}
		if opts.BearerToken != "" {
			return nil, fmt.Errorf("both `bearer_token`=%q and `bearer_token_file`=%q are set", opts.BearerToken, opts.BearerTokenFile)
		}
		actx.mustInitFromBearerTokenFile(baseDir, opts.BearerTokenFile)
	}
	if opts.BearerToken != "" {
		if actx.getAuthHeader != nil {
			return nil, fmt.Errorf("cannot simultaneously use `authorization`, `basic_auth` and `bearer_token`")
		}
		actx.mustInitFromBearerToken(opts.BearerToken)
	}
	if opts.OAuth2 != nil {
		if actx.getAuthHeader != nil {
			return nil, fmt.Errorf("cannot simultaneously use `authorization`, `basic_auth, `bearer_token` and `oauth2`")
		}
		if err := actx.initFromOAuth2Config(baseDir, opts.OAuth2); err != nil {
			return nil, fmt.Errorf("cannot initialize oauth2: %w", err)
		}
	}
	var tctx tlsContext
	if opts.TLSConfig != nil {
		if err := tctx.initFromTLSConfig(baseDir, opts.TLSConfig); err != nil {
			return nil, fmt.Errorf("cannot initialize tls: %w", err)
		}
	}
	headers, err := parseHeaders(opts.Headers)
	if err != nil {
		return nil, fmt.Errorf("cannot parse headers: %w", err)
	}
	hd := xxhash.New()
	for _, kv := range headers {
		_, _ = hd.Write([]byte(kv.key))

View on GitHub (pinned to 5079fb58f1)

Solutions

Keep only `oauth2` and delete `authorization`, `basic_auth`, and `bearer_token`/`bearer_token_file` from the scrape config
Or drop `oauth2` and use one of the other auth options exclusively

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at lib/promauth/config.go:735 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/89ee5e3865d5ed6e. Report an issue: GitHub.