proto: CreateAuthenticateChallengeRequest: illegal tag %d (w

Q: What causes "proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)" in gravitational/teleport?

Rebuild client and server against the same proto file versions

Error message

proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)

What it means

Generated Unmarshal code for CreateAuthenticateChallengeRequest returned an illegal-tag error: fieldNum<=0 or an unknown/unskippable field. The stream deviates from the expected schema for this message.

Source

Thrown at api/client/proto/authservice.pb.go:60033

				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field UserCredentials", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {

View on GitHub (pinned to 1283425b60)

Solutions

Rebuild client and server against the same proto file versions
Verify no middleware mutates or repackages the gRPC frame
Validate payload structure with protoc --decode_raw
Pin the api module version on both sides of the connection

Defensive patterns

Strategy: try-catch

Validate before calling

if len(payload) < 2 { return errors.New("payload too short for a protobuf message") }

Try / catch

var req proto.CreateAuthenticateChallengeRequest
if err := proto.Unmarshal(payload, &req); err != nil {
  return trace.AccessDenied("malformed challenge request")
}

Prevention

Never remove or reuse proto field numbers without a major version bump
Verify intermediaries don't rewrite gRPC frames
Test cross-version compatibility in CI
Regenerate .pb.go after every proto change and commit together

When it happens

Trigger: Decoding payload with an invalid or unrecognized field tag in CreateAuthenticateChallengeRequest, typically from mismatched proto versions or corrupted bytes.

Common situations: Client compiled against older proto where field numbers differ; proxy/intermediary rewriting messages; payload corruption in transit.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/76e02517c19764f4. Report an issue: GitHub.