{"record":{"id":"d5fd9f34d8b4c811","repo":"argoproj/argo-workflows","slug":"unsupported-authentication-scheme","errorCode":null,"errorMessage":"unsupported authentication scheme","messagePattern":"unsupported authentication scheme","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/kubeconfig/kubeconfig.go","lineNumber":54,"sourceCode":"\nfunc IsBearerAuthScheme(token string) bool {\n\treturn strings.HasPrefix(token, BearerAuthScheme)\n}\n\nfunc GetRestConfig(token string) (*restclient.Config, error) {\n\tif IsBasicAuthScheme(token) {\n\t\ttoken = strings.TrimSpace(strings.TrimPrefix(token, BasicAuthScheme))\n\t\tusername, password, ok := decodeBasicAuthToken(token)\n\t\tif !ok {\n\t\t\treturn nil, errors.New(\"error parsing basic authentication\")\n\t\t}\n\t\treturn GetBasicRestConfig(username, password)\n\t}\n\tif IsBearerAuthScheme(token) {\n\t\ttoken = strings.TrimSpace(strings.TrimPrefix(token, BearerAuthScheme))\n\t\treturn GetBearerRestConfig(token)\n\t}\n\treturn nil, errors.New(\"unsupported authentication scheme\")\n}\n\n// GetBasicRestConfig converts a basic token (username, password) into a REST config.\nfunc GetBasicRestConfig(username, password string) (*restclient.Config, error) {\n\trestConfig, err := restConfigWithoutAuth()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\trestConfig.Username = username\n\trestConfig.Password = password\n\treturn restConfig, nil\n}\n\n// GetBearerRestConfig converts a bearer token into a REST config.\nfunc GetBearerRestConfig(token string) (*restclient.Config, error) {\n\trestConfig, err := restConfigWithoutAuth()\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/kubeconfig/kubeconfig.go#L36-L72","documentation":"GetRestConfig only supports tokens prefixed with the basic ('Basic ') or bearer ('Bearer ') auth schemes; any token lacking a recognized scheme prefix falls through both branches and hits this sentinel error. It fires when a caller passes a raw credential, empty token, or mis-prefixed authorization string to DefaultClientForAuthorization when authenticating API requests.","triggerScenarios":"Thrown at util/kubeconfig/kubeconfig.go:54 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Send an Authorization header starting with 'Bearer ' or 'Basic '","Omit the header to fall through to the default in-cluster kubeconfig"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}