{"id":"362ddf03b1b7794b","repo":"gofiber/fiber","slug":"fiber-keyauth-scope-requires-insufficient-scope-e","errorCode":null,"errorMessage":"fiber: keyauth scope requires insufficient_scope error","messagePattern":"fiber: keyauth scope requires insufficient_scope error","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/keyauth/config.go","lineNumber":160,"sourceCode":"\tif cfg.ErrorURI != \"\" {\n\t\tif cfg.Error == \"\" {\n\t\t\tpanic(\"fiber: keyauth error_uri requires error\")\n\t\t}\n\t\tif u, err := url.Parse(cfg.ErrorURI); err != nil || !u.IsAbs() {\n\t\t\tpanic(\"fiber: keyauth error_uri must be absolute\")\n\t\t}\n\t}\n\tif cfg.Error == ErrorInsufficientScope {\n\t\tif cfg.Scope == \"\" {\n\t\t\tpanic(\"fiber: keyauth insufficient_scope requires scope\")\n\t\t}\n\t\tfor scope := range strings.SplitSeq(cfg.Scope, \" \") {\n\t\t\tif scope == \"\" || !isScopeToken(scope) {\n\t\t\t\tpanic(\"fiber: keyauth scope contains invalid token\")\n\t\t\t}\n\t\t}\n\t} else if cfg.Scope != \"\" {\n\t\tpanic(\"fiber: keyauth scope requires insufficient_scope error\")\n\t}\n\n\treturn cfg\n}\n\nfunc isScopeToken(s string) bool {\n\tfor i := 0; i < len(s); i++ {\n\t\tc := s[i]\n\t\tif c < 0x21 || c > 0x7e || c == '\"' || c == '\\\\' {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn s != \"\"\n}\n","sourceCodeStart":142,"sourceCodeEnd":175,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/keyauth/config.go#L142-L175","documentation":"The keyauth Config.Scope field is only valid when Config.Error is ErrorInsufficientScope, because scope is an RFC 6750 parameter specific to that error. Setting Scope while Error is empty or set to a different code panics in configDefault().","triggerScenarios":"Calling keyauth.New() with Config.Scope populated but Config.Error unset, or Error set to invalid_request/invalid_token. The else-if branch at config.go:159 catches any non-empty Scope not paired with insufficient_scope.","commonSituations":"Developer adds the Scope field intending to declare required scopes but never switches Error to insufficient_scope. Leftover Scope from an earlier config revision. Misunderstanding that Scope is challenge metadata, not a general required-scopes list.","solutions":["Set Config.Error to keyauth.ErrorInsufficientScope whenever you set Config.Scope.","If you only want to validate required scopes, implement that logic inside your Validator function instead of using the Scope field.","Remove Scope if you are not using the insufficient_scope challenge."],"exampleFix":"// before\napp.Use(keyauth.New(keyauth.Config{\n    Validator: validateKey,\n    Scope:     \"read write\",\n}))\n// after\napp.Use(keyauth.New(keyauth.Config{\n    Validator: validateKey,\n    Error:     keyauth.ErrorInsufficientScope,\n    Scope:     \"read write\",\n}))","handlingStrategy":"validation","validationCode":"if cfg.Scope != \"\" && cfg.Error != keyauth.ErrorInsufficientScope {\n    log.Fatal(\"keyauth: Scope is only valid when Error is insufficient_scope\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep Scope and Error=insufficient_scope together in one config block.","Implement required-scope enforcement inside Validator rather than misusing the Scope field."],"tags":["keyauth","config","auth","rfc6750","scope","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}