fatedier/frp · error

invalid auth method, optional values are %v

Error message

invalid auth method, optional values are %v

What it means

The client auth.method value is not one of the supported methods. frp's validator checks auth.Method against SupportedAuthMethods ("token", "oidc", and the empty default) and fails fast with the allowed list embedded in the message. This runs in validateAuthConfig during full client config validation.

Source

Thrown at pkg/config/v1/validation/client.go:102

			requirements.VirtualNet = true
			break
		}
	}
	if !requirements.VirtualNet {
		for _, cfg := range visitorCfgs {
			if cfg.GetBaseConfig().Plugin.Type == v1.VisitorPluginVirtualNet {
				requirements.VirtualNet = true
				break
			}
		}
	}
	return requirements
}

func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, error) {
	var errs error
	if !slices.Contains(SupportedAuthMethods, c.Method) {
		errs = AppendError(errs, fmt.Errorf("invalid auth method, optional values are %v", SupportedAuthMethods))
	}
	if !lo.Every(SupportedAuthAdditionalScopes, c.AdditionalScopes) {
		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
	}

	errs = AppendError(errs, v.validateAuthTokenSource(c.Token, c.TokenSource))

	if err := v.validateOIDCConfig(&c.OIDC); err != nil {
		errs = AppendError(errs, err)
	}
	if c.Method == v1.AuthMethodOIDC && c.OIDC.TokenSource == nil {
		if err := ValidateOIDCClientCredentialsConfig(&c.OIDC); err != nil {
			errs = AppendError(errs, err)
		}
	}
	return nil, errs
}

View on GitHub (pinned to 6c8a8d0a97)

Solutions

1. Set auth.method to a supported value — check the message's %v list, typically "token" or "oidc"
2. Remove auth.method entirely if you want the default (no auth)
3. Re-check for stray whitespace/case in the YAML/TOML value ("Token" vs "token")

Example fix

# before
[auth]
method = "tokn"
token = "x"

# after
[auth]
method = "token"
token = "x"

func validAuthMethod(m v1.AuthMethod) bool {
    return slices.Contains(validation.SupportedAuthMethods, m)
}
// use: if !validAuthMethod(cfg.Auth.Method) { /* fix before validate */ }

if _, err := validation.ValidateClientCommonConfig(cfg); err != nil {
    if strings.HasPrefix(err.Error(), "invalid auth method") {
        cfg.Auth.Method = v1.AuthMethodToken // sane fallback, then re-validate
    }
}

When it happens

Trigger: c.Auth.Method is set to anything not in SupportedAuthMethods, e.g. "ldap", "basic", "tokn" (typo), or a deprecated value from an older frp version (older releases used "token" only or different casing).

Common situations: Typos in auth.method; migrating configs from frp versions whose accepted method names changed; attempting to use a plugin-based auth scheme as a top-level method.

Related errors

• exec configuration is required when type is 'exec'
• file path cannot be empty
• cannot specify both auth.token and auth.tokenSource
• invalid auth.tokenSource: %v
• exec command cannot be empty

AI-assisted analysis of fatedier/frp@6c8a8d0a97 (2026-08-15). Data as JSON: /api/errors/9562a1572604ea9f. Report an issue: GitHub.