argoproj/argo-workflows · error

unsupported authentication scheme

Error message

unsupported authentication scheme

What it means

GetRestConfig only supports tokens prefixed with the basic ('Basic ') or bearer ('Bearer ') auth schemes; any token lacking a recognized scheme prefix falls through both branches and hits this sentinel error. It fires when a caller passes a raw credential, empty token, or mis-prefixed authorization string to DefaultClientForAuthorization when authenticating API requests.

Source

Thrown at util/kubeconfig/kubeconfig.go:54

func IsBearerAuthScheme(token string) bool {
	return strings.HasPrefix(token, BearerAuthScheme)
}

func GetRestConfig(token string) (*restclient.Config, error) {
	if IsBasicAuthScheme(token) {
		token = strings.TrimSpace(strings.TrimPrefix(token, BasicAuthScheme))
		username, password, ok := decodeBasicAuthToken(token)
		if !ok {
			return nil, errors.New("error parsing basic authentication")
		}
		return GetBasicRestConfig(username, password)
	}
	if IsBearerAuthScheme(token) {
		token = strings.TrimSpace(strings.TrimPrefix(token, BearerAuthScheme))
		return GetBearerRestConfig(token)
	}
	return nil, errors.New("unsupported authentication scheme")
}

// GetBasicRestConfig converts a basic token (username, password) into a REST config.
func GetBasicRestConfig(username, password string) (*restclient.Config, error) {
	restConfig, err := restConfigWithoutAuth()
	if err != nil {
		return nil, err
	}
	restConfig.Username = username
	restConfig.Password = password
	return restConfig, nil
}

// GetBearerRestConfig converts a bearer token into a REST config.
func GetBearerRestConfig(token string) (*restclient.Config, error) {
	restConfig, err := restConfigWithoutAuth()
	if err != nil {
		return nil, err

View on GitHub (pinned to 35bff19146)

Solutions

1. Send an Authorization header starting with 'Bearer ' or 'Basic '
2. Omit the header to fall through to the default in-cluster kubeconfig

When it happens

Trigger: Thrown at util/kubeconfig/kubeconfig.go:54 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/d5fd9f34d8b4c811. Report an issue: GitHub.