VictoriaMetrics/VictoriaMetrics · error

unsupported GCE token type received from %s: %q; supported:

Error message

unsupported GCE token type received from %s: %q; supported: %q

What it means

getGCEInstanceCreds requires the metadata token response to carry token_type exactly equal to "Bearer". If the endpoint returns a different or empty token_type, this error names the received type and the supported one. The returned credentials are used as the Yandex Cloud IAM bearer token for subsequent API calls, so a non-Bearer type cannot be used.

Source

Thrown at lib/promscrape/discovery/yandexcloud/api.go:176

		logger.Panicf("BUG: cannot create GCE token request for %s: %s", endpoint, err)
	}
	req.Header.Add("Metadata-Flavor", "Google")

	resp, err := cfg.client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("cannot obtain GCE token from %s: %w", endpoint, err)
	}
	data, err := readResponseBody(resp, endpoint)
	if err != nil {
		return nil, fmt.Errorf("cannot read GCE token from %s: %w", endpoint, err)
	}

	var ac gceAPICredentials
	if err := json.Unmarshal(data, &ac); err != nil {
		return nil, fmt.Errorf("cannot unmarshal GCE token from %s: %w; data=%s", endpoint, err, data)
	}
	if ac.TokenType != "Bearer" {
		return nil, fmt.Errorf("unsupported GCE token type received from %s: %q; supported: %q", endpoint, ac.TokenType, "Bearer")
	}

	expiration := time.Now().Add(time.Duration(ac.ExpiresIn) * time.Second)
	return &apiCredentials{
		Token:      ac.AccessToken,
		Expiration: expiration,
	}, nil
}

// See https://yandex.cloud/en/docs/compute/operations/vm-connect/auth-inside-vm#auth-inside-vm
type gceAPICredentials struct {
	AccessToken string `json:"access_token"`
	ExpiresIn   int    `json:"expires_in"`
	TokenType   string `json:"token_type"`
}

// getEC2IMDBSv1Creds gets Yandex Cloud IAM token using Amazon EC2 IMDBSv1
func getEC2IMDBSv1Creds(cfg *apiConfig) (*apiCredentials, error) {

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Inspect the quoted type in the error message to see what token_type the endpoint actually returned
2. Check the endpoint response manually (curl the metadata token URL) and confirm token_type is "Bearer"
3. If you control a metadata proxy/mimic, make it return token_type: "Bearer" (exact casing)
4. Update VictoriaMetrics if the cloud provider changed its token response format in a newer API version

Example fix

// before (proxy response)
{"access_token":"...","expires_in":3600,"token_type":"bearer"}
// after (proxy response fixed)
{"access_token":"...","expires_in":3600,"token_type":"Bearer"}

body, _ := fetchMetadataToken()
var probe struct{ TokenType string `json:"token_type"` }
if err := json.Unmarshal(body, &probe); err != nil || probe.TokenType != "Bearer" {
    return fmt.Errorf("metadata token_type must be Bearer, got %q", probe.TokenType)
}

func isBearerTokenType(data []byte) bool {
    var probe struct{ TokenType string `json:"token_type"` }
    if json.Unmarshal(data, &probe) != nil { return false }
    return probe.TokenType == "Bearer"
}

When it happens

Trigger: json.Unmarshal of the metadata response succeeds, but ac.TokenType is not "Bearer" — e.g. missing token_type field, lowercase "bearer", or a proxy returning a token object with a different type field.

Common situations: A metadata-server emulation (e.g. custom IMDS proxies, test doubles) that omits token_type; a Yandex/GCE metadata API change returning a different casing; hand-rolled mock endpoints in staging.

Related errors

• cannot unmarshal GCE token from %s: %w; data=%s
• cannot read Amazon EC2 IMDBSv1 token from %s: %w
• cannot parse Amazon EC2 IMDBSv1 token from %s: %w; data=%s
• cannot parse iam token from %s: %w; data: %s
• cannot determine the current project; make sure `vmagent` ru

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/8801d47b24a4d3cf. Report an issue: GitHub.