{"record":{"id":"ce9b4e0d1be5570c","repo":"honojs/hono","slug":"bearer-auth-middleware-requires-options-for-token","errorCode":null,"errorMessage":"bearer auth middleware requires options for \"token\" or \"verifyToken\"","messagePattern":"bearer auth middleware requires options for \"token\" or \"verifyToken\"","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/middleware/bearer-auth/index.ts","lineNumber":108,"sourceCode":" *\n * @example\n * ```ts\n * const app = new Hono()\n *\n * const token = 'honoishot'\n *\n * app.use('/api/*', bearerAuth({ token }))\n *\n * app.get('/api/page', (c) => {\n *   return c.json({ message: 'You are authorized' })\n * })\n * ```\n */\nexport const bearerAuth = <E extends Env = Env>(\n  options: BearerAuthOptions<E>\n): MiddlewareHandler<E> => {\n  if (!('token' in options || 'verifyToken' in options)) {\n    throw new Error('bearer auth middleware requires options for \"token\" or \"verifyToken\"')\n  }\n  if (!options.realm) {\n    options.realm = ''\n  }\n  if (options.prefix === undefined) {\n    options.prefix = PREFIX\n  }\n\n  const realm = options.realm?.replace(/\"/g, '\\\\\"')\n  const prefix = options.prefix\n  const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`)\n  const wwwAuthenticatePrefix = prefix === '' ? '' : `${prefix} `\n\n  const throwHTTPException = async (\n    c: Context,\n    status: ContentfulStatusCode,\n    wwwAuthenticateHeader: string | object | MessageFunction,\n    messageOption: string | object | MessageFunction","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/honojs/hono/blob/e2740d5a1bd0b4254e517e3af8b60789284bc7bd/src/middleware/bearer-auth/index.ts#L90-L126","documentation":"This error is thrown synchronously by bearerAuth() at middleware-creation time when the options object contains neither a static token nor a verifyToken function. The middleware needs one of these to decide which bearer tokens are valid, so it refuses to construct the handler. It is a configuration error that surfaces when your app builds its middleware chain, before any request is served.","triggerScenarios":"Calling bearerAuth({ realm: 'api' }) with no token; passing only part of the config like bearerAuth({ prefix: 'Token' }); misspelling the option (tokens: [...] instead of token or verifyToken); conditionally spreading options where the token branch is falsy so the key is absent.","commonSituations":"Copy-pasting an example without filling in the token, intending multi-token support but the API only accepts a single token string (use verifyToken for lists), reading the token from an env var that is undefined and destructuring it away, or refactoring config so verifyToken gets renamed.","solutions":["Pass a static token: bearerAuth({ token: process.env.API_TOKEN! })","Or pass a verifier for dynamic/multi-token checks: bearerAuth({ verifyToken: async (token) => tokens.includes(token) })","Ensure env vars are loaded before middleware construction and are non-empty","Check option spelling: it is exactly 'token' (string) or 'verifyToken' (function)"],"exampleFix":"// before\napp.use('/api/*', bearerAuth({ realm: 'api' }))\n\n// after\napp.use('/api/*', bearerAuth({\n  verifyToken: async (token) => token === process.env.API_TOKEN,\n}))","handlingStrategy":"validation","validationCode":"const hasBearerAuthCriteria = (o: Record<string, unknown>): boolean =>\n  'token' in o || 'verifyToken' in o\n\nif (!process.env.API_TOKEN) throw new Error('API_TOKEN missing')\nconst middleware = bearerAuth(hasBearerAuthCriteria(opts) ? opts : { token: process.env.API_TOKEN })","typeGuard":"type BearerAuthStatic = { token: string }\ntype BearerAuthDynamic = { verifyToken: (t: string, c: Context) => boolean | Promise<boolean> }\nconst hasBearerCriteria = (\n  o: Partial<BearerAuthStatic & BearerAuthDynamic>\n): o is BearerAuthStatic | BearerAuthDynamic =>\n  typeof o.token === 'string' || typeof o.verifyToken === 'function'","tryCatchPattern":null,"preventionTips":["Fail fast on missing env tokens at boot, not at middleware construction","Use verifyToken when you need multiple tokens or DB-backed validation","Add a unit test that constructs every middleware with production-like config"],"tags":["bearer-auth","middleware","configuration","hono","startup-error"],"backgroundTag":"middleware-misconfiguration","analyzedSha":"e2740d5a1bd0b4254e517e3af8b60789284bc7bd","analyzedAt":"2026-08-28T10:18:08.750Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}