apache/pulsar · error · IllegalArgumentException

Unsupported auth method: ${tokenEndpointAuthMethod}

Error message

Unsupported auth method: ${tokenEndpointAuthMethod}

What it means

AuthenticationFactoryOAuth2.build() dispatches on the configured TokenEndpointAuthMethod (CLIENT_SECRET_POST, CLIENT_SECRET_BASIC via the standard flow, or TLS_CLIENT_AUTH). Any other/unrecognized value reaches the final else branch and throws this IllegalArgumentException. Note the message template uses the raw method value, so the thrown text reads 'Unsupported auth method: <value>'.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationFactoryOAuth2.java:340

            } else if (tokenEndpointAuthMethod == TokenEndpointAuthMethod.TLS_CLIENT_AUTH) {
                if (StringUtils.isBlank(tlsCertFile) || StringUtils.isBlank(tlsKeyFile)) {
                    throw new IllegalArgumentException("Required configuration parameters: tlsCertFile, tlsKeyFile");
                }
                flow = TlsClientAuthFlow.builder()
                        .issuerUrl(issuerUrl)
                        .clientId(clientId)
                        .certFile(tlsCertFile)
                        .keyFile(tlsKeyFile)
                        .audience(audience)
                        .scope(scope)
                        .connectTimeout(connectTimeout)
                        .readTimeout(readTimeout)
                        .trustCertsFilePath(trustCertsFilePath)
                        .wellKnownMetadataPath(wellKnownMetadataPath)
                        .autoCertRefreshDuration(autoCertRefreshDuration)
                        .build();
            } else {
                throw new IllegalArgumentException("Unsupported auth method: " + tokenEndpointAuthMethod);
            }
            return new AuthenticationOAuth2(flow, earlyTokenRefreshPercent, scheduler);
        }

    }


}

View on GitHub (pinned to 820761864e)

Solutions

Set tokenEndpointAuthMethod to a supported value: client_secret_basic, client_secret_post, or tls_client_auth.
Fix string-to-enum mapping/typos in the configuration source.
Upgrade pulsar-client if the desired auth method is newer than your client version.

Example fix

// before
.tokenEndpointAuthMethod(TokenEndpointAuthMethod.valueOf("client_secret")) // no such enum -> throws
// after
.tokenEndpointAuthMethod(TokenEndpointAuthMethod.CLIENT_SECRET_POST)

Defensive patterns

Strategy: validation

Validate before calling

Set<TokenEndpointAuthMethod> supported = Set.of(
    TokenEndpointAuthMethod.CLIENT_SECRET_BASIC,
    TokenEndpointAuthMethod.CLIENT_SECRET_POST,
    TokenEndpointAuthMethod.TLS_CLIENT_AUTH);
if (!supported.contains(method)) {
    throw new IllegalStateException("Auth method not supported by this client version: " + method);
}

Try / catch

try {
    return builder.build();
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported auth method")) {
        throw new ConfigurationException("Use client_secret_basic/post or tls_client_auth", e);
    }
    throw e;
}

Prevention

Map config strings to enum values with a whitelist, not valueOf on raw input.
Keep client version and config docs in sync — new auth methods require newer clients.
Log the unsupported method value in your wrapper for easier diagnosis.

When it happens

Trigger: Passing an unknown TokenEndpointAuthMethod enum value (e.g. from parsing an arbitrary string) or null combined with no recognized default branch to build().

Common situations: Typo in a config file that maps strings to TokenEndpointAuthMethod (e.g. 'tls-auth' vs 'tls_client_auth'); running an older client version that lacks a newly introduced auth method; custom enum deserialization producing an unexpected value.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/8610179cebe2ad54. Report an issue: GitHub.