fatedier/frp · error

invalid auth.tokenSource: %v

Error message

invalid auth.tokenSource: %v

What it means

validateAuthTokenSource delegates to ValueSource.Validate() to check the tokenSource structure itself; any failure is wrapped as 'invalid auth.tokenSource'. This fires only when tokenSource is non-nil (and after the exec-type unsafe-feature check), so the wrapped error describes a malformed token source definition — unsupported type, missing required fields like path/command, or a bad combination of fields.

Source

Thrown at pkg/config/v1/validation/auth.go:40

)

func (v *ConfigValidator) validateAuthTokenSource(token string, tokenSource *v1.ValueSource) error {
	var errs error
	// Preserve the previous client/server validation order for joined errors.
	if token != "" && tokenSource != nil {
		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
	}
	if tokenSource == nil {
		return errs
	}

	if tokenSource.Type == "exec" {
		if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
			errs = AppendError(errs, err)
		}
	}
	if err := tokenSource.Validate(); err != nil {
		errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
	}
	return errs
}

View on GitHub (pinned to 6c8a8d0a97)

Solutions

1. Read the wrapped text after 'invalid auth.tokenSource:' — it names the exact structural problem (type or missing field).
2. For type="file", supply a readable path; for type="exec", supply the command; use only types supported by this frp version.
3. For type="exec", also ensure the exec token source is permitted (unsafe-feature flag/policy), otherwise a companion error will persist after the structural fix.

Example fix

# before
[auth.tokenSource]
type = "file"

# after
[auth.tokenSource]
type = "file"
path = "/run/secrets/frp-token"

// Structural pre-check mirroring ValueSource.Validate for the common types.
func validTokenSource(ts *v1.ValueSource) error {
	if ts == nil {
		return nil
	}
	switch ts.Type {
	case "file":
		if ts.Path == "" {
			return fmt.Errorf("tokenSource type file requires path")
		}
	case "exec":
		if len(ts.Command) == 0 {
			return fmt.Errorf("tokenSource type exec requires command")
		}
	default:
		return fmt.Errorf("unsupported tokenSource type %q", ts.Type)
	}
	return nil
}

func tokenSourceLooksComplete(ts *v1.ValueSource) bool {
	if ts == nil {
		return true
	}
	switch ts.Type {
	case "file":
		return ts.Path != ""
	case "exec":
		return len(ts.Command) > 0
	}
	return false
}

if err := validation.Validate(clientCfg); err != nil {
	if strings.Contains(err.Error(), "invalid auth.tokenSource") {
		// wrapped text names the structural problem: type or missing path/command
	}
	return err
}

When it happens

Trigger: Config validation with a tokenSource whose type is not a supported ValueSource type, or a supported type missing its required field: type="file" without path, type="exec" without a command. Produced whenever auth.tokenSource is present and fails its own Validate().

Common situations: Typos in tokenSource type values; forgetting the path/command key when adopting secret-file or exec-based token retrieval; version differences in supported ValueSource types; also appears alongside unsafe-feature errors for type="exec" when the feature is not enabled.

Related errors

• exec configuration is required when type is 'exec'
• file path cannot be empty
• cannot specify both auth.token and auth.tokenSource
• invalid auth method, optional values are %v
• exec command cannot be empty

AI-assisted analysis of fatedier/frp@6c8a8d0a97 (2026-08-15). Data as JSON: /api/errors/ad34ca4eebedbd1b. Report an issue: GitHub.