{"record":{"id":"91bb44f3efcfcc99","repo":"router-for-me/CLIProxyAPI","slug":"plugin-store-resolved-auth-token-is-empty","errorCode":null,"errorMessage":"plugin store resolved auth token is empty","messagePattern":"plugin store resolved auth token is empty","errorType":"http","errorClass":null,"httpStatus":502,"severity":"error","filePath":"internal/pluginstore/auth.go","lineNumber":280,"sourceCode":"\tcase AuthTypeGitHubToken:\n\t\ttoken, errToken := envValueRequired(item.TokenEnv, \"token-env\")\n\t\tif errToken != nil {\n\t\t\treturn false, errToken\n\t\t}\n\t\theaders.Set(\"Authorization\", \"Bearer \"+token)\n\tdefault:\n\t\treturn false, fmt.Errorf(\"unsupported plugin store auth type %q\", item.Type)\n\t}\n\treturn true, nil\n}\n\nfunc applyResolvedPluginStoreAuth(headers http.Header, item ResolvedAuthConfig) (bool, error) {\n\tswitch strings.ToLower(strings.TrimSpace(item.Type)) {\n\tcase \"\", AuthTypeNone:\n\t\treturn false, nil\n\tcase AuthTypeBearer, AuthTypeGitHubToken:\n\t\tif len(item.Token) == 0 {\n\t\t\treturn false, fmt.Errorf(\"plugin store resolved auth token is empty\")\n\t\t}\n\t\theaders.Set(\"Authorization\", \"Bearer \"+string(item.Token))\n\tcase AuthTypeBasic:\n\t\tif len(item.Username) == 0 || len(item.Password) == 0 {\n\t\t\treturn false, fmt.Errorf(\"plugin store resolved basic auth is incomplete\")\n\t\t}\n\t\tcredential := make([]byte, 0, len(item.Username)+1+len(item.Password))\n\t\tcredential = append(credential, item.Username...)\n\t\tcredential = append(credential, ':')\n\t\tcredential = append(credential, item.Password...)\n\t\tencoded := base64.StdEncoding.EncodeToString(credential)\n\t\tfor index := range credential {\n\t\t\tcredential[index] = 0\n\t\t}\n\t\theaders.Set(\"Authorization\", \"Basic \"+encoded)\n\tcase AuthTypeHeader:\n\t\tif strings.TrimSpace(item.HeaderName) == \"\" {\n\t\t\treturn false, fmt.Errorf(\"plugin store resolved auth missing header-name\")","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/pluginstore/auth.go#L262-L298","documentation":"The resolved-auth applier (used when auth secrets have already been materialized into ResolvedAuthConfig, e.g. from the management API or a secret store) rejects bearer/github-token auth when the resolved Token field is empty. Unlike the env-based path, nothing is read from the environment here — the token must already be present in the resolved struct.","triggerScenarios":"A resolved store auth of type bearer or github-token whose token resolved to empty: the referenced secret was missing, the secret key name wrong, or the management operation submitted an auth object without a token.","commonSituations":"Management API requests updating plugin store auth without the token field; secret store entry deleted or renamed after the store was configured; env var referenced by the resolver unset at resolution time.","solutions":["Supply a non-empty token in the resolved auth (re-submit via the management API or fix the source config)","Verify the secret/token reference actually resolves: check the secret key name and that the env var or secret store value exists","If the token is intentionally absent, set auth type to none instead of bearer"],"exampleFix":"# before\nPUT /management/plugin-store\n{\"auth\": {\"type\": \"bearer\"}}\n\n# after\nPUT /management/plugin-store\n{\"auth\": {\"type\": \"bearer\", \"token\": \"<resolved-token-value>\"}}","handlingStrategy":"validation","validationCode":"func validateResolvedAuth(item ResolvedAuthConfig) error {\n    switch strings.ToLower(strings.TrimSpace(item.Type)) {\n    case \"bearer\", \"github-token\":\n        if len(item.Token) == 0 {\n            return fmt.Errorf(\"auth type %q requires a resolved token\", item.Type)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify secrets resolve to non-empty values before submitting store auth via the management API","Automate checks that referenced secret keys exist in the secret store"],"tags":["config","plugin-store","auth","secrets","management-api"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}