{"record":{"id":"d2cb0a69250dae44","repo":"kubernetes/kops","slug":"invalid-authorization-token","errorCode":null,"errorMessage":"invalid authorization token","messagePattern":"invalid authorization token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/do/verifier.go","lineNumber":67,"sourceCode":"\t}\n\n\ttokenSource := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})\n\tdoClient := godo.NewClient(oauth2.NewClient(ctx, tokenSource))\n\n\treturn &digitalOceanVerifier{\n\t\tdoClient: doClient,\n\t}, nil\n}\n\nfunc (o digitalOceanVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {\n\tif !strings.HasPrefix(token, dometadata.DOAuthenticationTokenPrefix) {\n\t\treturn nil, bootstrap.ErrNotThisVerifier\n\t}\n\tserverIDString := strings.TrimPrefix(token, dometadata.DOAuthenticationTokenPrefix)\n\n\tserverID, err := strconv.Atoi(serverIDString)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid authorization token\")\n\t}\n\n\tdroplet, _, err := o.doClient.Droplets.Get(ctx, serverID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get info for server %v: %w\", token, err)\n\t}\n\n\tvar addresses []string\n\tvar challengeEndpoints []string\n\tif droplet.Networks != nil {\n\t\tfor _, nic := range droplet.Networks.V4 {\n\t\t\tif nic.Type == \"private\" {\n\t\t\t\taddresses = append(addresses, nic.IPAddress)\n\t\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(nic.IPAddress, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t\t}\n\t\t}\n\t\tfor _, nic := range droplet.Networks.V6 {\n\t\t\tif nic.Type == \"private\" {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/do/verifier.go#L49-L85","documentation":"Format-validation sentinel in the DO verifier: after stripping the x-digitalocean-droplet-id prefix, the remaining token text is not a valid integer (strconv.Atoi failed), so the token cannot identify a droplet. Indicates a malformed bootstrap token rather than a bad credential per se.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/do/verifier.go:67 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the token on the node (kops-controller/nodeup bootstrap)","Check that nodeup's CreateToken is producing the ID correctly","Report if tokens are consistently malformed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}