gofiber/fiber · error

fiber: keyauth error_uri requires error

Error message

fiber: keyauth error_uri requires error

What it means

The keyauth Config.ErrorURI field (RFC 6750 error_uri) points clients to a page describing the error and is only valid alongside an Error code. Setting ErrorURI while Error is empty panics in configDefault() because the challenge would be malformed without its required error parameter.

Source

Thrown at middleware/keyauth/config.go:144

	}

	if len(getAuthSchemes(cfg.Extractor)) == 0 && cfg.Challenge == "" {
		cfg.Challenge = fmt.Sprintf("ApiKey realm=%q", cfg.Realm)
	}

	if cfg.Error != "" {
		switch cfg.Error {
		case ErrorInvalidRequest, ErrorInvalidToken, ErrorInsufficientScope:
		default:
			panic("fiber: keyauth unsupported error token")
		}
	}
	if cfg.ErrorDescription != "" && cfg.Error == "" {
		panic("fiber: keyauth error_description requires error")
	}
	if cfg.ErrorURI != "" {
		if cfg.Error == "" {
			panic("fiber: keyauth error_uri requires error")
		}
		if u, err := url.Parse(cfg.ErrorURI); err != nil || !u.IsAbs() {
			panic("fiber: keyauth error_uri must be absolute")
		}
	}
	if cfg.Error == ErrorInsufficientScope {
		if cfg.Scope == "" {
			panic("fiber: keyauth insufficient_scope requires scope")
		}
		for scope := range strings.SplitSeq(cfg.Scope, " ") {
			if scope == "" || !isScopeToken(scope) {
				panic("fiber: keyauth scope contains invalid token")
			}
		}
	} else if cfg.Scope != "" {
		panic("fiber: keyauth scope requires insufficient_scope error")
	}

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Always set Config.Error to a valid code (invalid_request, invalid_token, insufficient_scope) when ErrorURI is set.
2. If you only want to send a help link, move that logic into a custom Config.ErrorHandler instead.
3. Use a config-building helper that asserts Error is set before allowing ErrorURI.

Example fix

// before
app.Use(keyauth.New(keyauth.Config{
    Validator: validateKey,
    ErrorURI:  "https://example.com/docs/auth-errors",
}))
// after
app.Use(keyauth.New(keyauth.Config{
    Validator: validateKey,
    Error:     keyauth.ErrorInvalidToken,
    ErrorURI:  "https://example.com/docs/auth-errors",
}))

if cfg.ErrorURI != "" && cfg.Error == "" {
    log.Fatal("keyauth: ErrorURI requires Error to be set")
}

When it happens

Trigger: Calling keyauth.New() with a non-empty Config.ErrorURI but Config.Error left empty. The library checks ErrorURI before Error in the validation order, so even a valid absolute URL here panics if Error is unset.

Common situations: Adding a help link to 401 responses without specifying why the request failed. Reorganizing config and dropping the Error field while leaving the URI. Assuming ErrorURI works as a standalone documentation pointer.

Related errors

• fiber: keyauth unsupported error token
• fiber: keyauth error_description requires error
• fiber: keyauth error_uri must be absolute
• fiber: keyauth insufficient_scope requires scope
• fiber: keyauth scope contains invalid token

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/aefc9be827b6ae83.json. Report an issue: GitHub.