What causes "auth plugin %s given, but authParams is empty" in apache/pulsar?

Set AuthenticationParams to "token: " or "file:///path/to/token".

auth plugin %s given, but authParams is empty

Error message

auth plugin %s given, but authParams is empty

What it means

When the function instance is configured with the token auth plugin, setupClient inspects ic.authParams. If authParams is empty, no token can be attached to the Pulsar client and setupClient returns this error, aborting instance startup.

Source

Thrown at pulsar-function-go/pf/instance.go:224

func (gi *goInstance) setupClient() error {
	ic := gi.context.instanceConf

	clientOpts := pulsar.ClientOptions{
		URL:                        ic.pulsarServiceURL,
		TLSTrustCertsFilePath:      ic.tlsTrustCertsPath,
		TLSAllowInsecureConnection: ic.tlsAllowInsecure,
		TLSValidateHostname:        ic.tlsHostnameVerification,
	}

	switch ic.authPlugin {
	case authPluginToken:
		switch {
		case strings.HasPrefix(ic.authParams, "file://"):
			clientOpts.Authentication = pulsar.NewAuthenticationTokenFromFile(ic.authParams[7:])
		case strings.HasPrefix(ic.authParams, "token:"):
			clientOpts.Authentication = pulsar.NewAuthenticationToken(ic.authParams[6:])
		case ic.authParams == "":
			return fmt.Errorf("auth plugin %s given, but authParams is empty", authPluginToken)
		default:
			return fmt.Errorf(`unknown token format - expecting "file://" or "token:" prefix`)
		}
	case authPluginNone:
		clientOpts.Authentication, _ = pulsar.NewAuthentication("", "") // ret: auth.NewAuthDisabled()
	default:
		return fmt.Errorf("unknown auth provider: %s", ic.authPlugin)
	}

	client, err := pulsar.NewClient(clientOpts)
	if err != nil {
		log.Errorf("create client error:%v", err)
		gi.stats.incrTotalSysExceptions(err)
		return err
	}
	gi.client = client
	return nil
}

View on GitHub (pinned to 820761864e)

Solutions

Set AuthenticationParams to "token:<TOKEN>" or "file:///path/to/token".
If using env-based config, ensure AUTH_PARAMS is exported in the container.
Verify the secret/volume providing the token is mounted and non-empty.

Example fix

// before
--auth_plugin token --auth_params "" // error: authParams is empty
// after
--auth_plugin token --auth_params "token:eyJhbGciOi..."

Defensive patterns

Strategy: validation

Validate before calling

if strings.EqualFold(authPlugin, "token") && authParams == "" {
    return fmt.Errorf("token auth selected but authParams is empty")
}

Try / catch

if err := runInstance(); err != nil {
    if strings.Contains(err.Error(), "authParams is empty") {
        log.Fatalf("provide AUTH_PARAMS with token:<jwt> or file://<path>")
    }
    log.Fatal(err)
}

Prevention

Inject the token via a mounted secret and set AUTH_PARAMS explicitly.
Fail fast in entrypoint scripts when required auth env vars are empty.
Validate function config at deploy time (lint the function manifest).

When it happens

Trigger: Setting AuthenticationPlugin to the token plugin (authPluginToken) in the instance config while leaving AuthenticationParams unset/empty.

Common situations: Deploying with auth enabled but forgetting to inject the token via AUTH_PARAMS; k8s secret not mounted so the param resolves to empty; config template placeholder left unfilled.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/e2ad745256bce0aa. Report an issue: GitHub.