{"record":{"id":"8212735f01d0c419","repo":"languagetool-org/languagetool","slug":"unknown-authmethod-authparameter","errorCode":null,"errorMessage":"Unknown authMethod: <authParameter>","messagePattern":"Unknown authMethod: <authParameter>","errorType":"http","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"languagetool-server/src/main/java/org/languagetool/server/ApiV2.java","lineNumber":366,"sourceCode":"    if (httpExchange.getRequestMethod().equalsIgnoreCase(\"options\")) {\n      ServerTools.setAllowOrigin(httpExchange, allowOriginUrl);\n      httpExchange.getResponseHeaders().put(\"Access-Control-Allow-Methods\", Collections.singletonList(\"GET, OPTIONS\"));\n      List<String> requestHeaders = httpExchange.getRequestHeaders().get(\"Access-Control-Request-Headers\");\n      if (requestHeaders != null) {\n        httpExchange.getResponseHeaders().put(\"Access-Control-Allow-Headers\", Collections.singletonList(String.join(\", \", requestHeaders)));\n      }\n      httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_NO_CONTENT, -1);\n      ServerMetricsCollector.getInstance().logResponse(HttpURLConnection.HTTP_NO_CONTENT);\n    } else {\n      ensureGetMethod(httpExchange, \"/users/me\");\n      if (!httpExchange.getRequestHeaders().containsKey(\"Authorization\")) {\n        throw new AuthException(\"Expected Basic Authentication\");\n      }\n      String authParameter = parameters.getOrDefault(\"authMethod\", \"password\");\n      if (!(authParameter.equals(\"password\") || \n            authParameter.equals(\"apiKey\") || \n            authParameter.equals(\"addonToken\"))) {\n        throw new IllegalArgumentException(\"Unknown authMethod: \" + authParameter);\n      }\n\n      String authHeader = httpExchange.getRequestHeaders().getFirst(\"Authorization\");\n      BasicAuthentication basicAuthentication = new BasicAuthentication(authHeader);\n      String user = basicAuthentication.getUser();\n      String password = basicAuthentication.getPassword();\n      UserInfoEntry userInfo = null;\n\n      if (authParameter.equals(\"password\")) {\n        userInfo = DatabaseAccess.getInstance().getUserInfoWithPassword(user, password);\n      } else if (authParameter.equals(\"addonToken\")) {\n        userInfo = DatabaseAccess.getInstance().getUserInfoWithAddonToken(user, password);\n      } else if (authParameter.equals(\"apiKey\")) {\n        userInfo = DatabaseAccess.getInstance().getUserInfoWithApiKey(user, password);\n      }\n\n      String format = parameters.getOrDefault(\"format\", \"extended\");\n      if (userInfo != null) {","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/languagetool-org/languagetool/blob/2e990059ce67d5e2a0f7f7ca5d31160c6709df4b/languagetool-server/src/main/java/org/languagetool/server/ApiV2.java#L348-L384","documentation":"The optional 'authMethod' query parameter of /v2/users/me must be one of 'password', 'apiKey', or 'addonToken'; any other value makes handleGetUserInfoRequest throw an IllegalArgumentException listing the offending value. It tells the server how to interpret the password part of the Basic auth credentials.","triggerScenarios":"GET /v2/users/me?authMethod=oauth (unsupported value); typo like 'apikey' vs 'apiKey'; client library emitting an auth method this server version does not know.","commonSituations":"Newer/older client-server version mismatches where one side supports an auth method the other doesn't; hand-written query strings with wrong casing.","solutions":["Set authMethod to one of exactly: password, apiKey, addonToken (case-sensitive).","Omit the authMethod parameter entirely to use the default 'password'.","Fix casing: 'apiKey' with a capital K, not 'apikey' or 'api_key'."],"exampleFix":"// before\nGET /v2/users/me?authMethod=apikey\n// after\nGET /v2/users/me?authMethod=apiKey","handlingStrategy":"validation","validationCode":"const ALLOWED = ['password', 'apiKey', 'addonToken'];\nif (authMethod && !ALLOWED.includes(authMethod)) throw new Error(`authMethod must be one of ${ALLOWED.join(', ')}`);","typeGuard":"function isValidAuthMethod(v) {\n  return v === undefined || ['password', 'apiKey', 'addonToken'].includes(v);\n}","tryCatchPattern":null,"preventionTips":["Keep an allowlist of valid authMethod values ('password', 'apiKey', 'addonToken') in client code.","Omit authMethod to get the 'password' default.","Match casing exactly when upgrading client libraries."],"tags":["http","authentication","rest-api","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"2e990059ce67d5e2a0f7f7ca5d31160c6709df4b","analyzedAt":"2026-09-06T09:20:17.015Z","contentChangedAt":"2026-09-06T09:20:17.015Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}