{"id":"9582c4c437cfda3d","repo":"gofiber/fiber","slug":"fiber-keyauth-unsupported-error-token","errorCode":null,"errorMessage":"fiber: keyauth unsupported error token","messagePattern":"fiber: keyauth unsupported error token","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/keyauth/config.go","lineNumber":136,"sourceCode":"\tif cfg.Realm == \"\" {\n\t\tcfg.Realm = ConfigDefault.Realm\n\t}\n\tif cfg.SuccessHandler == nil {\n\t\tcfg.SuccessHandler = ConfigDefault.SuccessHandler\n\t}\n\tif cfg.ErrorHandler == nil {\n\t\tcfg.ErrorHandler = ConfigDefault.ErrorHandler\n\t}\n\n\tif len(getAuthSchemes(cfg.Extractor)) == 0 && cfg.Challenge == \"\" {\n\t\tcfg.Challenge = fmt.Sprintf(\"ApiKey realm=%q\", cfg.Realm)\n\t}\n\n\tif cfg.Error != \"\" {\n\t\tswitch cfg.Error {\n\t\tcase ErrorInvalidRequest, ErrorInvalidToken, ErrorInsufficientScope:\n\t\tdefault:\n\t\t\tpanic(\"fiber: keyauth unsupported error token\")\n\t\t}\n\t}\n\tif cfg.ErrorDescription != \"\" && cfg.Error == \"\" {\n\t\tpanic(\"fiber: keyauth error_description requires error\")\n\t}\n\tif cfg.ErrorURI != \"\" {\n\t\tif cfg.Error == \"\" {\n\t\t\tpanic(\"fiber: keyauth error_uri requires error\")\n\t\t}\n\t\tif u, err := url.Parse(cfg.ErrorURI); err != nil || !u.IsAbs() {\n\t\t\tpanic(\"fiber: keyauth error_uri must be absolute\")\n\t\t}\n\t}\n\tif cfg.Error == ErrorInsufficientScope {\n\t\tif cfg.Scope == \"\" {\n\t\t\tpanic(\"fiber: keyauth insufficient_scope requires scope\")\n\t\t}\n\t\tfor scope := range strings.SplitSeq(cfg.Scope, \" \") {","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/keyauth/config.go#L118-L154","documentation":"The keyauth middleware validates the Config.Error field against the three RFC 6750 Bearer token error codes (invalid_request, invalid_token, insufficient_scope). Setting Error to any other string panics during configDefault() at middleware construction. The library enforces this so WWW-Authenticate challenge responses stay spec-compliant.","triggerScenarios":"Calling keyauth.New() with a Config whose Error field is set to a custom string like \"forbidden\" or \"unauthorized\" (or a typo like \"invalid token\" with a space). Any value not exactly equal to ErrorInvalidRequest, ErrorInvalidToken, or ErrorInsufficientScope triggers the panic.","commonSituations":"Developer copies an error code from documentation but mistypes it, or assumes free-form error strings are allowed. Migrating from a custom auth scheme and reusing internal error names that don't match RFC 6750. Copy-pasting between projects where constants differ.","solutions":["Set Config.Error to one of the package constants: keyauth.ErrorInvalidRequest, keyauth.ErrorInvalidToken, or keyauth.ErrorInsufficientScope.","If you need a custom error message, leave Error empty and instead customize Config.ErrorHandler to send your own response.","Double-check there are no typos or extra whitespace in the string value."],"exampleFix":"// before\napp.Use(keyauth.New(keyauth.Config{\n    Validator:  validateKey,\n    Error:      \"forbidden\",\n}))\n// after\napp.Use(keyauth.New(keyauth.Config{\n    Validator:  validateKey,\n    Error:      keyauth.ErrorInvalidToken,\n}))","handlingStrategy":"validation","validationCode":"validErrors := map[string]struct{}{\n    keyauth.ErrorInvalidRequest:    {},\n    keyauth.ErrorInvalidToken:      {},\n    keyauth.ErrorInsufficientScope: {},\n}\nif cfg.Error != \"\" {\n    if _, ok := validErrors[cfg.Error]; !ok {\n        log.Fatalf(\"invalid keyauth Error %q\", cfg.Error)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use the package constants (keyauth.ErrorInvalidToken etc.) instead of string literals.","Centralize keyauth config construction in one helper so the Error value is validated in one place."],"tags":["keyauth","config","auth","rfc6750","panic"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}