{"record":{"id":"8801d47b24a4d3cf","repo":"VictoriaMetrics/VictoriaMetrics","slug":"unsupported-gce-token-type-received-from-s-q-s","errorCode":null,"errorMessage":"unsupported GCE token type received from %s: %q; supported: %q","messagePattern":"unsupported GCE token type received from (.+?): %q; supported: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promscrape/discovery/yandexcloud/api.go","lineNumber":176,"sourceCode":"\t\tlogger.Panicf(\"BUG: cannot create GCE token request for %s: %s\", endpoint, err)\n\t}\n\treq.Header.Add(\"Metadata-Flavor\", \"Google\")\n\n\tresp, err := cfg.client.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot obtain GCE token from %s: %w\", endpoint, err)\n\t}\n\tdata, err := readResponseBody(resp, endpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot read GCE token from %s: %w\", endpoint, err)\n\t}\n\n\tvar ac gceAPICredentials\n\tif err := json.Unmarshal(data, &ac); err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot unmarshal GCE token from %s: %w; data=%s\", endpoint, err, data)\n\t}\n\tif ac.TokenType != \"Bearer\" {\n\t\treturn nil, fmt.Errorf(\"unsupported GCE token type received from %s: %q; supported: %q\", endpoint, ac.TokenType, \"Bearer\")\n\t}\n\n\texpiration := time.Now().Add(time.Duration(ac.ExpiresIn) * time.Second)\n\treturn &apiCredentials{\n\t\tToken:      ac.AccessToken,\n\t\tExpiration: expiration,\n\t}, nil\n}\n\n// See https://yandex.cloud/en/docs/compute/operations/vm-connect/auth-inside-vm#auth-inside-vm\ntype gceAPICredentials struct {\n\tAccessToken string `json:\"access_token\"`\n\tExpiresIn   int    `json:\"expires_in\"`\n\tTokenType   string `json:\"token_type\"`\n}\n\n// getEC2IMDBSv1Creds gets Yandex Cloud IAM token using Amazon EC2 IMDBSv1\nfunc getEC2IMDBSv1Creds(cfg *apiConfig) (*apiCredentials, error) {","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promscrape/discovery/yandexcloud/api.go#L158-L194","documentation":"getGCEInstanceCreds requires the metadata token response to carry token_type exactly equal to \"Bearer\". If the endpoint returns a different or empty token_type, this error names the received type and the supported one. The returned credentials are used as the Yandex Cloud IAM bearer token for subsequent API calls, so a non-Bearer type cannot be used.","triggerScenarios":"json.Unmarshal of the metadata response succeeds, but ac.TokenType is not \"Bearer\" — e.g. missing token_type field, lowercase \"bearer\", or a proxy returning a token object with a different type field.","commonSituations":"A metadata-server emulation (e.g. custom IMDS proxies, test doubles) that omits token_type; a Yandex/GCE metadata API change returning a different casing; hand-rolled mock endpoints in staging.","solutions":["Inspect the quoted type in the error message to see what token_type the endpoint actually returned","Check the endpoint response manually (curl the metadata token URL) and confirm token_type is \"Bearer\"","If you control a metadata proxy/mimic, make it return token_type: \"Bearer\" (exact casing)","Update VictoriaMetrics if the cloud provider changed its token response format in a newer API version"],"exampleFix":"// before (proxy response)\n{\"access_token\":\"...\",\"expires_in\":3600,\"token_type\":\"bearer\"}\n// after (proxy response fixed)\n{\"access_token\":\"...\",\"expires_in\":3600,\"token_type\":\"Bearer\"}","handlingStrategy":"validation","validationCode":"body, _ := fetchMetadataToken()\nvar probe struct{ TokenType string `json:\"token_type\"` }\nif err := json.Unmarshal(body, &probe); err != nil || probe.TokenType != \"Bearer\" {\n    return fmt.Errorf(\"metadata token_type must be Bearer, got %q\", probe.TokenType)\n}","typeGuard":"func isBearerTokenType(data []byte) bool {\n    var probe struct{ TokenType string `json:\"token_type\"` }\n    if json.Unmarshal(data, &probe) != nil { return false }\n    return probe.TokenType == \"Bearer\"\n}","tryCatchPattern":null,"preventionTips":["If you run a metadata proxy/mimic, always emit token_type: \"Bearer\" with exact casing","Test the endpoint response with curl before wiring it into yandexcloud_sd","Log the raw token response (minus the secret) when debugging auth issues"],"tags":["metadata-server","auth-token","yandex-cloud","token-type"],"backgroundTag":"unsupported-token-type","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}