{"record":{"id":"1207f5e04fd9ffd0","repo":"ory/hydra","slug":"unsupported-auth-type-q","errorCode":null,"errorMessage":"unsupported auth type %q","messagePattern":"unsupported auth type %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oauth2/token_hook.go","lineNumber":87,"sourceCode":"\tName  string `json:\"name\"`\n\tValue string `json:\"value\"`\n}\n\nfunc applyAuth(req *retryablehttp.Request, auth *config.Auth) error {\n\tif auth == nil {\n\t\treturn nil\n\t}\n\n\tswitch auth.Type {\n\tcase \"api_key\":\n\t\tswitch auth.Config.In {\n\t\tcase \"header\":\n\t\t\treq.Header.Set(auth.Config.Name, auth.Config.Value)\n\t\tcase \"cookie\":\n\t\t\treq.AddCookie(&http.Cookie{Name: auth.Config.Name, Value: auth.Config.Value})\n\t\t}\n\tdefault:\n\t\treturn errors.Errorf(\"unsupported auth type %q\", auth.Type)\n\t}\n\treturn nil\n}\n\nfunc executeHookAndUpdateSession(ctx context.Context, reg httpx.ClientProvider, hookConfig *config.HookConfig, reqBodyBytes []byte, session *Session) error {\n\treq, err := retryablehttp.NewRequestWithContext(ctx, http.MethodPost, hookConfig.URL, bytes.NewReader(reqBodyBytes))\n\tif err != nil {\n\t\treturn errors.WithStack(\n\t\t\tfosite.ErrServerError.\n\t\t\t\tWithWrap(err).\n\t\t\t\tWithDescription(\"An error occurred while preparing the token hook.\").\n\t\t\t\tWithDebugf(\"Unable to prepare the HTTP Request: %s\", err),\n\t\t)\n\t}\n\tif err := applyAuth(req, hookConfig.Auth); err != nil {\n\t\treturn errors.WithStack(\n\t\t\tfosite.ErrServerError.\n\t\t\t\tWithWrap(err).","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oauth2/token_hook.go#L69-L105","documentation":"applyAuth applies authentication material to an outgoing token hook request. It supports api_key (header/cookie), client_basic, and client_secret_bearer style auth; when auth.Type matches none of the known types the switch's default branch returns this error with the offending type name.","triggerScenarios":"Configuring an OAuth2 token hook with auth.type set to a value other than the supported ones (e.g. a typo like 'headers', 'api-key', or a new unsupported type), then triggering a token hook request during a token/refresh/code exchange.","commonSituations":"Typo or wrong casing in the hook configuration (auth.type); copying config from another product with different auth type names; a config schema migration that renamed the allowed values.","solutions":["Set auth.type to a supported value (e.g. api_key with auth.config.type header/cookie, client_basic, client_secret_bear)","Check for typos/casing in the auth.type config field","Validate the hook configuration against the HookConfig schema before deploying","If you need a new auth type, extend the switch in oauth2/token_hook.go applyAuth"],"exampleFix":"// before\nauth:\n  type: api-key\n// after\nauth:\n  type: api_key\n  config:\n    type: header\n    name: X-API-Key\n    value: secret","handlingStrategy":"validation","validationCode":"var validAuthTypes = map[string]bool{\"api_key\": true, \"client_basic\": true, \"client_secret_bear\": true}\nif hook.Auth != nil && !validAuthTypes[hook.Auth.Type] {\n    return fmt.Errorf(\"hook auth.type %q not supported\", hook.Auth.Type)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate hook configuration against the schema at deploy time","Keep auth.type values in a shared constant list matching the switch cases","Add config linting/CI checks for hook definitions","When adding auth types, update both config schema and applyAuth together"],"tags":["configuration","oauth2","token-hook","http"],"backgroundTag":"unsupported-auth-type","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}