apache/pulsar · error · IllegalArgumentException

Unsupported media type or encoding format:

Error message

Unsupported media type or encoding format: 

What it means

loadPrivateKey accepts data: URIs only when their content type is exactly 'data:application/x-pem-file' (APPLICATION_X_PEM_FILE). Any other media type or encoding in the data URI causes IllegalArgumentException('Unsupported media type or encoding format: <contentType>').

Source

Thrown at pulsar-client-auth-athenz/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationAthenz.java:322

        try {
            java.net.URL url = new URL(urlString).openConnection().getURL();
            checkArgument("file".equals(url.getProtocol()), "Unsupported protocol: %s", url.getProtocol());
            Path path = Paths.get(url.getPath());
            return path.isAbsolute() ? path.toString() : path.toAbsolutePath().toString();
        } catch (URISyntaxException e) {
            throw new IllegalArgumentException("Invalid URL format", e);
        } catch (InstantiationException | IllegalAccessException | IOException e) {
            throw new IllegalArgumentException("Cannnot get absolute path from specified URL", e);
        }
    }

    private static PrivateKey loadPrivateKey(String privateKeyURL) {
        PrivateKey privateKey = null;
        try {
            URLConnection urlConnection = new URL(privateKeyURL).openConnection();
            String protocol = urlConnection.getURL().getProtocol();
            if ("data".equals(protocol) && !APPLICATION_X_PEM_FILE.equals(urlConnection.getContentType())) {
                throw new IllegalArgumentException(
                        "Unsupported media type or encoding format: " + urlConnection.getContentType());
            }
            String keyData = CharStreams.toString(new InputStreamReader((InputStream) urlConnection.getContent(),
                    Charset.defaultCharset()));
            privateKey = Crypto.loadPrivateKey(keyData);
        } catch (URISyntaxException e) {
            throw new IllegalArgumentException("Invalid privateKey format", e);
        } catch (CryptoException | InstantiationException | IllegalAccessException | IOException e) {
            privateKey = null;
        }
        return privateKey;
    }
}

View on GitHub (pinned to 820761864e)

Solutions

1. Format the key as 'data:application/x-pem-file;base64,<base64 of PEM>'
2. If you have the raw PEM text, use the unencoded form 'data:application/x-pem-file,<pem text>' or a file:// privateKeyPath URL instead
3. Re-encode: base64 -w0 key.pem and paste with the exact media type shown above

Example fix

// before
"privateKey":"data:application/octet-stream;base64,LS0tLS1CRUdJTg=="
// after
"privateKey":"data:application/x-pem-file;base64,LS0tLS1CRUdJTg=="

if (privateKeyValue.startsWith("data:")) {
    String meta = privateKeyValue.substring(5, privateKeyValue.indexOf(','));
    if (!meta.startsWith("application/x-pem-file")) {
        throw new IllegalArgumentException("data URI must use media type application/x-pem-file, got: " + meta);
    }
}

boolean isPemDataUri(String s) {
    return s != null && s.startsWith("data:application/x-pem-file,");
}

try {
    authentication.configure(authParamsJson);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported media type")) {
        log.error("Re-encode the key as data:application/x-pem-file;base64,...");
    }
    throw e;
}

When it happens

Trigger: Passing a privateKey value like 'data:application/octet-stream;base64,...' or 'data:text/plain;base64,...' (wrong MIME type) to configure(); also firing when the data URI omits or misspells the media type.

Common situations: Users base64-encoding their PEM key but labeling it with the wrong content type, or omitting the ';base64' indicator; older docs/configs showing a different MIME label.

Related errors

• Invalid privateKey format
• Failed to parse authParams
• Failed to load private key from privateKey or privateKeyPath
• Invalid URL format
• Cannnot get absolute path from specified URL

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/474e00116eec0167. Report an issue: GitHub.