{"record":{"id":"38009150a54eb87f","repo":"apache/pulsar","slug":"unknown-token-format-expecting-file-or-tok","errorCode":null,"errorMessage":"unknown token format - expecting \"file://\" or \"token:\" prefix","messagePattern":"unknown token format - expecting \"file://\" or \"token:\" prefix","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pulsar-function-go/pf/instance.go","lineNumber":226,"sourceCode":"\n\tclientOpts := pulsar.ClientOptions{\n\t\tURL:                        ic.pulsarServiceURL,\n\t\tTLSTrustCertsFilePath:      ic.tlsTrustCertsPath,\n\t\tTLSAllowInsecureConnection: ic.tlsAllowInsecure,\n\t\tTLSValidateHostname:        ic.tlsHostnameVerification,\n\t}\n\n\tswitch ic.authPlugin {\n\tcase authPluginToken:\n\t\tswitch {\n\t\tcase strings.HasPrefix(ic.authParams, \"file://\"):\n\t\t\tclientOpts.Authentication = pulsar.NewAuthenticationTokenFromFile(ic.authParams[7:])\n\t\tcase strings.HasPrefix(ic.authParams, \"token:\"):\n\t\t\tclientOpts.Authentication = pulsar.NewAuthenticationToken(ic.authParams[6:])\n\t\tcase ic.authParams == \"\":\n\t\t\treturn fmt.Errorf(\"auth plugin %s given, but authParams is empty\", authPluginToken)\n\t\tdefault:\n\t\t\treturn fmt.Errorf(`unknown token format - expecting \"file://\" or \"token:\" prefix`)\n\t\t}\n\tcase authPluginNone:\n\t\tclientOpts.Authentication, _ = pulsar.NewAuthentication(\"\", \"\") // ret: auth.NewAuthDisabled()\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown auth provider: %s\", ic.authPlugin)\n\t}\n\n\tclient, err := pulsar.NewClient(clientOpts)\n\tif err != nil {\n\t\tlog.Errorf(\"create client error:%v\", err)\n\t\tgi.stats.incrTotalSysExceptions(err)\n\t\treturn err\n\t}\n\tgi.client = client\n\treturn nil\n}\n\nfunc (gi *goInstance) setupProducer() error {","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-function-go/pf/instance.go#L208-L244","documentation":"With the token auth plugin selected, authParams must use either the \"file://\" prefix (token read from a file) or the \"token:\" prefix (inline token). Any other format hits the default case and returns this error, stopping the instance.","triggerScenarios":"authParams set to a raw JWT without the \"token:\" prefix, or a path without the \"file://\" prefix, or any other arbitrary string while the token plugin is enabled.","commonSituations":"Copy-pasting a JWT directly into auth params; using \"File://\" or \"file:/\" wrong casing/spelling; mixing up param formats from a different auth plugin.","solutions":["Prefix inline tokens: authParams = \"token:\" + jwt.","Prefix file paths exactly: authParams = \"file:///etc/pulsar/token\".","If you don't need auth, switch AuthenticationPlugin to the none plugin instead."],"exampleFix":"// before\n--auth_params \"eyJhbGciOi...\" // unknown token format\n// after\n--auth_params \"token:eyJhbGciOi...\"","handlingStrategy":"validation","validationCode":"if authParams != \"\" && !strings.HasPrefix(authParams, \"file://\") && !strings.HasPrefix(authParams, \"token:\") {\n    return fmt.Errorf(\"authParams must start with file:// or token:\")\n}","typeGuard":null,"tryCatchPattern":"if err := runInstance(); err != nil && strings.Contains(err.Error(), \"unknown token format\") {\n    log.Fatalf(`fix authParams: use \"token:<jwt>\" or \"file:///path\"`)\n}","preventionTips":["Always build authParams as \"token:\"+jwt or \"file://\"+absPath in deploy tooling.","Note the prefix is case-sensitive and lowercase.","Document the expected format next to the function config template."],"tags":["go","authentication","token","configuration"],"backgroundTag":"invalid-token-format","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}