What causes "auth token is required but not provided" in crowdsecurity/crowdsec?

Check the securityScheme 'in' field (query/header/cookie) matches where the client actually sends the credential

auth token is required but not provided

Error message

auth token is required but not provided

What it means

After all securityScheme type/in handlers run, the validator checks that an auth token was actually extracted. If the scheme is one the validator recognizes structurally but no code path set authTokenValue (e.g. apiKey in a location that yielded nothing, or the token extraction was skipped), this final guard fires.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:294

					return fmt.Errorf("multiple cookies with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = cookieValues[0].Value
			default:
				return fmt.Errorf("unsupported apiKey location %s", input.SecurityScheme.In)
			}
		case "oauth2", "openIdConnect":
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("%s security scheme not supported", input.SecurityScheme.Type)
		default:
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("unsupported security scheme type %s", input.SecurityScheme.Type)
		}
		if authTokenValue == "" {
			return errors.New("auth token is required but not provided")
		}

		return nil
	}
}

func (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {
	if ref == "" {
		return errors.New("ref cannot be empty")
	}
	rv.logger.Debugf("loading schema for ref %s", ref)

	if _, exists := rv.loaders[ref]; exists {
		return fmt.Errorf("attempting to load a new schema for existing ref %s", ref)
	}

	options := opts.withDefaults()
	if err := options.OnRouteNotFound.validate(); err != nil {

View on GitHub (pinned to 909b515798)

Solutions

Check the securityScheme 'in' field (query/header/cookie) matches where the client actually sends the credential
Have the client send the credential in the location the scheme declares (e.g. ?api_key=... for in=query)
If the scheme type is genuinely unsupported, set the appropriate policy (unsupportedPolicy=PolicyIgnore) or use a supported scheme type
Fix typos in the OpenAPI component so the expected header/query name matches the client's

Example fix

// spec before
"in": "head"
// spec after
"in": "header"

Defensive patterns

Strategy: validation

Validate before calling

scheme, _ := spec.Components.SecuritySchemes[name]; if scheme.In != "header" && scheme.In != "query" && scheme.In != "cookie" { return fmt.Errorf("unsupported securityScheme in=%q", scheme.In) }

Try / catch

if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), "auth token is required") { /* 401: credential missing in declared location */ } }

Prevention

Verify the securityScheme 'in' value matches where the client sends the key
Test each protected route with and without the credential
Avoid exotic scheme type/in combinations not supported by the validator; use PolicyIgnore deliberately

When it happens

Trigger: Request validation completes the scheme switch without setting authTokenValue (it remains "") — for example a security scheme whose combination of type/in didn't populate the token, while the scheme is still enforced (not PolicyIgnore).

Common situations: OpenAPI securityScheme declared with an unusual In value (cookie/header typo) so the apiKey extraction reads the wrong location and finds nothing; spec references a scheme variant the validator doesn't extract tokens for; requests legitimately missing the apiKey but the operation still requires it.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4f184779f4888717. Report an issue: GitHub.