crowdsecurity/crowdsec · error

invalid auth_type: must be one of basic_auth, headers, mtls

Error message

invalid auth_type: must be one of basic_auth, headers, mtls

What it means

The http acquisition source's auth_type is set to a value other than the three supported ones: basic_auth, headers, or mtls. Validate() uses a switch over AuthType and its default branch rejects anything unrecognized. This catches typos, wrong casing, and auth schemes the source does not implement.

Source

Thrown at pkg/acquisition/modules/http/config.go:126

		}

		if c.BasicAuth.Username == "" {
			return errors.New(baseErr + " username is not provided")
		}

		if c.BasicAuth.Password == "" {
			return errors.New(baseErr + " password is not provided")
		}
	case "headers":
		if c.Headers == nil {
			return errors.New("headers is selected, but headers is not provided")
		}
	case "mtls":
		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	/*
		if hc.ChunkSize != nil && *hc.ChunkSize <= 0 {

View on GitHub (pinned to 909b515798)

Solutions

1. Set auth_type to exactly one of: basic_auth, headers, mtls (lowercase, no whitespace)
2. If using basic_auth, add the basic_auth block with username/password; if headers, add a headers map; if mtls, add tls with server_cert/server_key/ca_cert
3. Remove surrounding quotes/spaces or fix casing in the YAML value
4. Check the documentation for the http source to confirm supported auth_type values in your CrowdSec version

Example fix

# before
source: http
listen_addr: 127.0.0.1:8080
auth_type: mTLS
# after
source: http
listen_addr: 127.0.0.1:8080
auth_type: mtls
tls:
  server_cert: /etc/ssl/server.crt
  server_key: /etc/ssl/server.key

valid := map[string]bool{"basic_auth": true, "headers": true, "mtls": true}
if !valid[cfg.AuthType] {
    return fmt.Errorf("auth_type %q not supported; use basic_auth, headers or mtls", cfg.AuthType)
}

func authTypeSupported(t string) bool {
    switch t {
    case "basic_auth", "headers", "mtls":
        return true
    }
    return false
}

if _, err := httpacquisition.ConfigurationFromYAML(y); err != nil {
    if strings.Contains(err.Error(), "invalid auth_type") {
        return fmt.Errorf("acquisition file rejected, fix auth_type: %w", err)
    }
    return err
}

When it happens

Trigger: YAML config sets auth_type to something like "mTLS", "mtls ", "token", "none", "client_cert", or is misspelled ("basicauth"). Also fires when auth_type is an unexpected type coerced oddly. Raised by Configuration.Validate() (config.go:125-126) during acquisition file load.

Common situations: Typo or wrong casing ("mTLS" instead of "mtls"), copying config from another product that supports other auth schemes (api_key, bearer, none), forgetting to set auth_type entirely so it stays empty and hits the default branch.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• mtls is selected, but ca_cert is not provided
• server_cert is required
• server_key is required
• max_body_size must be positive
• invalid threshold: must be > 0 and <= 1

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/53105dcba812f9b2. Report an issue: GitHub.