fatedier/frp · error

unsupported auth method: %s

Error message

unsupported auth method: %s

What it means

NewAuthSetter hit the default switch branch: the configured auth method string matches neither 'token' nor 'oidc', so no auth provider can be constructed. This is a strict config validation failure at startup before any networking happens.

Source

Thrown at pkg/auth/auth.go:78

		key:    []byte(resolved.Token),
	}, nil
}

func NewAuthSetter(cfg v1.AuthClientConfig) (authProvider Setter, err error) {
	switch cfg.Method {
	case v1.AuthMethodToken:
		authProvider = NewTokenAuth(cfg.AdditionalScopes, cfg.Token)
	case v1.AuthMethodOIDC:
		if cfg.OIDC.TokenSource != nil {
			authProvider = NewOidcTokenSourceAuthSetter(cfg.AdditionalScopes, cfg.OIDC.TokenSource)
		} else {
			authProvider, err = NewOidcAuthSetter(cfg.AdditionalScopes, cfg.OIDC)
			if err != nil {
				return nil, err
			}
		}
	default:
		return nil, fmt.Errorf("unsupported auth method: %s", cfg.Method)
	}
	return authProvider, nil
}

type Verifier interface {
	VerifyLogin(*msg.Login) error
	VerifyPing(*msg.Ping) error
	VerifyNewWorkConn(*msg.NewWorkConn) error
}

type ServerAuth struct {
	Verifier Verifier
	key      []byte
}

func (a *ServerAuth) EncryptionKey() []byte {
	return a.key
}

View on GitHub (pinned to 6c8a8d0a97)

Solutions

1. Set auth.method to exactly 'token' or 'oidc' (lowercase) per the v1 schema.
2. When building configs in code, run the validation layer before constructing auth so callers get a proper error message.
3. Check for stray whitespace or case differences in the config value.

Example fix

# before (frpc.toml)
[auth]
method = "Token"

# after
[auth]
method = "token"
token = "real-secret"

switch cfg.Method {
case v1.AuthMethodToken, v1.AuthMethodOIDC:
default:
    return fmt.Errorf("auth.method must be token or oidc, got %q", cfg.Method)
}

func isValidAuthMethod(m v1.AuthMethod) bool {
    return m == v1.AuthMethodToken || m == v1.AuthMethodOIDC
}

When it happens

Trigger: cfg.Method is an arbitrary or misspelled string (e.g., 'Token', 'tokens', empty) because upstream validation did not run or a custom code path bypassed it.

Common situations: Typo or wrong case in auth.method in the config file; programmatically built configs skipping validation before calling NewAuthSetter; version drift where a method valid in one release or fork is passed to another that doesn't know it.

Related errors

• auth.oidc.clientID is required; auth.oidc.tokenEndpointURL i
• exec configuration is required when type is 'exec'
• file path cannot be empty
• cannot specify both auth.token and auth.tokenSource
• invalid auth.tokenSource: %v

AI-assisted analysis of fatedier/frp@6c8a8d0a97 (2026-08-15). Data as JSON: /api/errors/980796b1397d2177. Report an issue: GitHub.