Dgraph.Authorization should be only be specified once in a s

Error message

Dgraph.Authorization should be only be specified once in a schema, found second mention: %v

What it means

parseMetaInfo scans schema comments for special headers (# Dgraph.Authorization, # Dgraph.Allow-Origin). Because only one authorization configuration is allowed per schema, a second `# Dgraph.Authorization` comment line causes this error, indicating ambiguous auth config.

Source

Thrown at graphql/schema/schemagen.go:212

	return m.authMeta
}

func parseMetaInfo(sch string) (*metaInfo, error) {
	scanner := bufio.NewScanner(strings.NewReader(sch))
	authSecret := ""
	schMetaInfo := &metaInfo{
		secrets:            make(map[string]x.Sensitive),
		allowedCorsOrigins: make(map[string]bool),
	}
	var err error
	for scanner.Scan() {
		text := strings.TrimSpace(scanner.Text())

		if strings.HasPrefix(text, "#") {
			header := strings.TrimSpace(text[1:])
			if strings.HasPrefix(header, "Dgraph.Authorization") {
				if authSecret != "" {
					return nil, errors.Errorf("Dgraph.Authorization should be only be specified once in "+
						"a schema, found second mention: %v", text)
				}
				authSecret = text
				continue
			}

			if strings.HasPrefix(header, "Dgraph.Allow-Origin") {
				parts := strings.Fields(text)
				if len(parts) != 3 {
					return nil, errors.Errorf("incorrect format for specifying Dgraph.Allow-Origin"+
						" found for comment: `%s`, it should be `# Dgraph."+
						"Allow-Origin \"http://example.com\"`", text)
				}
				var allowedOrigin string
				if err = json.Unmarshal([]byte(parts[2]), &allowedOrigin); err != nil {
					return nil, errors.Errorf("incorrect format for specifying Dgraph.Allow-Origin"+
						" found for comment: `%s`, it should be `# Dgraph."+
						"Allow-Origin \"http://example.com\"`", text)

View on GitHub (pinned to 759e242be6)

Solutions

Remove all but one `# Dgraph.Authorization` comment from the schema, keeping the intended one.
If concatenating schema fragments, strip meta headers from all but the first fragment.
Centralize the auth header in a single schema source (e.g. the base schema file).

Example fix

// before
# Dgraph.Authorization http://demo.io 100 group1
type User {...}
# Dgraph.Authorization http://other.io 200 group2
// after
# Dgraph.Authorization http://demo.io 100 group1
type User {...}

Defensive patterns

Strategy: validation

Validate before calling

// ensure only one Dgraph.Authorization header exists before submit
var count int
for _, line := range strings.Split(schemaText, "\n") {
    if strings.HasPrefix(strings.TrimSpace(line), "# Dgraph.Authorization") {
        count++
    }
}
if count > 1 {
    return fmt.Errorf("found %d Dgraph.Authorization headers, expected 1", count)
}

Try / catch

h, err := schema.NewHandler(...)
if err != nil {
    if strings.Contains(err.Error(), "Dgraph.Authorization should be only be specified once") {
        return fmt.Errorf("auth header duplicated in schema: %w", err)
    }
    return err
}

Prevention

Keep the Dgraph.Authorization header in exactly one canonical schema file.
Strip meta headers from schema fragments before concatenation.
Lint schema files for duplicate `# Dgraph.` headers in CI.
Document that only one auth header is allowed.

When it happens

Trigger: Calling NewHandler (or schema generation paths that invoke parseMetaInfo) with a schema string containing two or more comment lines starting with `# Dgraph.Authorization`.

Common situations: Concatenating multiple schema files that each carry their own Dgraph.Authorization header; copy-pasting the auth header into a schema that already had one; merging schemas from env + file.

Related errors

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/8e0461ea50b145b9. Report an issue: GitHub.