apache/pulsar · error · IllegalArgumentException

Unsupported token endpoint auth method: ${value}

Error message

Unsupported token endpoint auth method: ${value}

What it means

TokenEndpointAuthMethod.fromValue maps a string to the supported token-endpoint auth method enum (client_secret_basic, client_secret_post, private_key_jwt, etc.). If no enum constant matches the given value (case-insensitively), this IllegalArgumentException is thrown. The configured auth method is not supported by this client.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/protocol/TokenEndpointAuthMethod.java:41

    TLS_CLIENT_AUTH("tls_client_auth");

    private final String value;

    TokenEndpointAuthMethod(String value) {
        this.value = value;
    }

    public String value() {
        return value;
    }

    public static TokenEndpointAuthMethod fromValue(String value) {
        for (TokenEndpointAuthMethod method : values()) {
            if (method.value.equalsIgnoreCase(value)) {
                return method;
            }
        }
        throw new IllegalArgumentException("Unsupported token endpoint auth method: " + value);
    }
}

View on GitHub (pinned to 820761864e)

Solutions

1. Change the configured value to one of the enum's supported methods (check TokenEndpointAuthMethod.values(): client_secret_basic, client_secret_post, private_key_jwt).
2. Fix typos and use the exact method name the IdP metadata advertises among the supported ones.
3. If the IdP requires an unsupported method, re-register the client with a supported auth method or use a different grant type.

Example fix

// before
config.put("tokenEndpointAuthMethod", "none"); // throws
// after
config.put("tokenEndpointAuthMethod", "client_secret_basic");

static void validateAuthMethod(String v) {
    java.util.Set<String> supported = java.util.Set.of("client_secret_basic", "client_secret_post", "private_key_jwt");
    if (v == null || supported.stream().noneMatch(s -> s.equalsIgnoreCase(v))) {
        throw new IllegalArgumentException("tokenEndpointAuthMethod must be one of " + supported + ", got: " + v);
    }
}

try {
    client = AuthenticationFactoryOAuth2.clientCredentials(issuerUrl, credFile, audience);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Unsupported token endpoint auth method")) {
        throw new ConfigException("Use a supported method (client_secret_basic, client_secret_post, private_key_jwt)", e);
    }
    throw e;
}

When it happens

Trigger: Supplying an unsupported value for the token endpoint auth method in the OAuth2 client configuration — e.g. 'client_secret_jwt', 'none', 'basic', or a misspelled 'client_secred_post' — typically via the authParams/config map passed to the OAuth2 Authentication.

Common situations: Config values copied from an IdP's supported methods list that the Pulsar client doesn't implement; typos in YAML/JSON config; assuming 'none'/public-client auth is supported when only secret/JWT methods are.

Related errors

• Unsupported auth method: ${authMethod}
• Unsupported authentication type: ${type}
• No authentication parameters were provided
• certFilePath must not be null
• keyFilePath must not be null

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/fe176208579040ee. Report an issue: GitHub.