What causes "No token credentials passed" in apache/pulsar?

Configure the client's authParams with the token (e.g. authParams=token:eyJ... or authParams=file:///path/token)

apache/pulsar · error · AuthenticationException

No token credentials passed

Error message

No token credentials passed

What it means

getToken() throws this AuthenticationException when the AuthenticationDataSource contains neither command data nor HTTP data carrying a token — i.e. the client supplied no token credentials at all. Unlike the header-format errors, this means the request simply had no credentials in any recognized channel.

Source

Thrown at pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java:220

    }

    public static String getToken(AuthenticationDataSource authData) throws AuthenticationException {
        if (authData.hasDataFromCommand()) {
            // Authenticate Pulsar binary connection
            return validateToken(authData.getCommandData());
        } else if (authData.hasDataFromHttp()) {
            // Authentication HTTP request. The format here should be compliant to RFC-6750
            // (https://tools.ietf.org/html/rfc6750#section-2.1). Eg: Authorization: Bearer xxxxxxxxxxxxx
            String httpHeaderValue = authData.getHttpHeader(HTTP_HEADER_NAME);
            if (httpHeaderValue == null || !httpHeaderValue.startsWith(HTTP_HEADER_VALUE_PREFIX)) {
                throw new AuthenticationException("Invalid HTTP Authorization header");
            }

            // Remove prefix
            String token = httpHeaderValue.substring(HTTP_HEADER_VALUE_PREFIX.length());
            return validateToken(token);
        } else {
            throw new AuthenticationException("No token credentials passed");
        }
    }

    private static String validateToken(final String token) throws AuthenticationException {
        if (StringUtils.isNotBlank(token)) {
            return token;
        } else {
            throw new AuthenticationException("Blank token found");
        }
    }

    @SuppressWarnings("unchecked")
    private Jws<Claims> authenticateToken(final String token) throws AuthenticationException {
        try {
            Jws<Claims> jwt = parser.parseClaimsJws(token);

            if (audienceClaim != null) {
                Object object = jwt.getBody().get(audienceClaim);

View on GitHub (pinned to 820761864e)

Solutions

Configure the client's authParams with the token (e.g. authParams=token:eyJ... or authParams=file:///path/token)
Verify the client's authentication plugin is set to 'token' and the broker lists AuthenticationProviderToken in authProviders
Check the connect command actually carries auth data before authentication is attempted

Example fix

# before
authPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
# authParams missing
// after
authPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
authParams=eyJhbGciOiJIUzI1NiJ9...

Defensive patterns

Strategy: validation

Validate before calling

if (!authData.hasDataFromCommand() && !authData.hasDataFromHttp()) {
    throw new AuthenticationException("No token credentials supplied");
}

Try / catch

try {
    role = provider.authenticate(authData);
} catch (AuthenticationException e) {
    log.warn("No token credentials passed; check client authParams", e);
}

Prevention

Set authParams with a non-empty token on every client
Verify the connect command carries authentication data
Check configuration template ships a real token path or value

When it happens

Trigger: authenticate()/getToken() called with an AuthenticationDataSource that has no command data (hasDataFromCommand() false) and no HTTP data (hasDataFromHttp() false), e.g. empty or unset auth data.

Common situations: Client configured with the token auth plugin but no token value supplied (empty authParams); a proxy forwarding an authenticated connection but dropping the auth data; protocol-level auth not attached on the initial connect command.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/446ba87b813dc47b. Report an issue: GitHub.