proto: CreateAuthenticateChallengeRequest: wiretype end grou

Error message

proto: CreateAuthenticateChallengeRequest: wiretype end group for non-group

What it means

Same class of gogo/protobuf generated decode error, but for the CreateAuthenticateChallengeRequest message: a wire type 4 (end-group) tag was encountered where no group field exists. The byte stream is not a valid CreateAuthenticateChallengeRequest encoding.

Source

Thrown at api/client/proto/authservice.pb.go:60030

		var wire uint64
		for shift := uint(0); ; shift += 7 {
			if shift >= 64 {
				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field UserCredentials", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]

View on GitHub (pinned to 1283425b60)

Solutions

Ensure the sender marshals CreateAuthenticateChallengeRequest, not another type
Check for byte-offset bugs (slicing the payload at the wrong index)
Align proto definitions between client and server; rebuild both
Decode the payload with protoc --decode_raw to identify where the stream diverges

Example fix

// before
var req proto.CreateAuthenticateChallengeRequest
req.Unmarshal(rawBytes) // rawBytes are actually a Passwordless message
// after
var req proto.CreateAuthenticateChallengeRequest
if err := proto.Unmarshal(createChallengeBytes, &req); err != nil { return trace.Wrap(err) }

Defensive patterns

Strategy: try-catch

Validate before calling

if len(payload) == 0 || payload[0]&0x7 == 4 { return errors.New("payload is not a valid CreateAuthenticateChallengeRequest") }

Type guard

func isLengthDelimitedFirstField(b []byte) bool {
  return len(b) > 0 && b[0]&0x7 == 2
}

Try / catch

var req proto.CreateAuthenticateChallengeRequest
if err := proto.Unmarshal(payload, &req); err != nil {
  return trace.BadParameter("could not decode challenge request: %v", err)
}

Prevention

Confirm the sender's message type matches the receiver's endpoint
Keep a single generated source of truth for proto types
Avoid slicing buffers at manual offsets; use codec framing
Add integration tests covering client/server version skew

When it happens

Trigger: Unmarshal (or gRPC receive) of bytes whose next tag has wireType==4 for CreateAuthenticateChallengeRequest — corrupted stream, wrong message type bytes, or offset misalignment.

Common situations: Sending bytes of Passwordless (or another message) to an endpoint expecting CreateAuthenticateChallengeRequest; corrupted transport; version skew after proto changes.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/ad60ce3446563987. Report an issue: GitHub.