{"record":{"id":"b523bc09f1b035ec","repo":"fatedier/frp","slug":"failed-to-resolve-auth-tokensource-w","errorCode":null,"errorMessage":"failed to resolve auth.tokenSource: %w","messagePattern":"failed to resolve auth\\.tokenSource: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/auth/auth.go","lineNumber":50,"sourceCode":"\tSetter Setter\n\tkey    []byte\n}\n\nfunc (a *ClientAuth) EncryptionKey() []byte {\n\treturn a.key\n}\n\n// BuildClientAuth resolves any dynamic auth values and returns a prepared auth runtime.\n// Caller must run validation before calling this function.\nfunc BuildClientAuth(cfg *v1.AuthClientConfig) (*ClientAuth, error) {\n\tif cfg == nil {\n\t\treturn nil, fmt.Errorf(\"auth config is nil\")\n\t}\n\tresolved := *cfg\n\tif resolved.Method == v1.AuthMethodToken && resolved.TokenSource != nil {\n\t\ttoken, err := resolved.TokenSource.Resolve(context.Background())\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to resolve auth.tokenSource: %w\", err)\n\t\t}\n\t\tresolved.Token = token\n\t}\n\tsetter, err := NewAuthSetter(resolved)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &ClientAuth{\n\t\tSetter: setter,\n\t\tkey:    []byte(resolved.Token),\n\t}, nil\n}\n\nfunc NewAuthSetter(cfg v1.AuthClientConfig) (authProvider Setter, err error) {\n\tswitch cfg.Method {\n\tcase v1.AuthMethodToken:\n\t\tauthProvider = NewTokenAuth(cfg.AdditionalScopes, cfg.Token)\n\tcase v1.AuthMethodOIDC:","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/auth/auth.go#L32-L68","documentation":"BuildClientAuth failed to resolve the dynamic token source: auth.method is 'token' and auth.tokenSource is configured, so the client calls TokenSource.Resolve(context.Background()) at startup to obtain the concrete token, and that external resolution failed. The wrapped error comes from the token source implementation (file read, command exec, or remote fetch).","triggerScenarios":"A v1.AuthClientConfig with Method=token and TokenSource set whose Resolve() errors: token file missing or unreadable, exec command returning non-zero, or a token endpoint unreachable.","commonSituations":"auth.tokenSource file path missing on the frpc host; tokenSource cmd binary not in PATH or failing under the frpc service account; secrets injection (systemd, vault agent) not finished before frpc starts.","solutions":["Run the token source manually as the frpc service user (cat the file or execute the cmd) and fix whatever fails.","If it is a race with secret provisioning, add dependency ordering (e.g., systemd After= on the secret mount) or a wrapper that waits for the token file.","Verify the tokenSource config block matches your frp version's schema.","If dynamic tokens are not required, remove tokenSource and set auth.token directly."],"exampleFix":"# before\n[auth]\nmethod = \"token\"\n[auth.tokenSource]\ncmd = \"/usr/local/bin/get-token\"\n\n# after: confirm it runs as the frpc user\nsudo -u frpc /usr/local/bin/get-token   # must exit 0 and print the token","handlingStrategy":"validation","validationCode":"if cfg.Method == v1.AuthMethodToken && cfg.TokenSource != nil {\n    if _, err := cfg.TokenSource.Resolve(context.Background()); err != nil {\n        return fmt.Errorf(\"token source broken before deploy: %w\", err)\n    }\n}","typeGuard":"func hasResolvableTokenSource(cfg *v1.AuthClientConfig) bool {\n    return cfg != nil && cfg.Method == v1.AuthMethodToken && cfg.TokenSource != nil\n}","tryCatchPattern":"if _, err := auth.BuildClientAuth(cfg); err != nil {\n    if strings.Contains(err.Error(), \"auth.tokenSource\") {\n        // provisioning problem: fix the source, don't retry\n    }\n}","preventionTips":["Pre-flight the token source (file/cmd) as the frpc service user","Order service startup after secret mounts","Alert on token-resolution failures separately from network errors"],"tags":["auth","token","config","secrets"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}