What causes "proto: wrong wireType = %d for field RecoveryStartTokenID" in gravitational/teleport?

Rebuild both endpoints from the same authservice.proto

proto: wrong wireType = %d for field RecoveryStartTokenID

Error message

proto: wrong wireType = %d for field RecoveryStartTokenID

What it means

The decoder expects field 2 (RecoveryStartTokenID, a string) to be wire type 2 (length-delimited). Any other wire type on tag 2 triggers this error during CreateAuthenticateChallengeRequest unmarshaling.

Source

Thrown at api/client/proto/authservice.pb.go:60073

			if msglen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + msglen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			v := &UserCredentials{}
			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
				return err
			}
			m.Request = &CreateAuthenticateChallengeRequest_UserCredentials{v}
			iNdEx = postIndex
		case 2:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field RecoveryStartTokenID", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

Rebuild both endpoints from the same authservice.proto
Set RecoveryStartTokenID via the generated struct field so Marshal emits wire type 2
Inspect the payload with protoc --decode_raw to confirm field 2's encoding
Clear stale generated .pb.go artifacts and regenerate

Example fix

// before
// hand-encoded field 2 as varint
// after
req := &proto.CreateAuthenticateChallengeRequest{
  Request: &proto.CreateAuthenticateChallengeRequest_RecoveryStartTokenID{"tok"},
}
b, _ := req.Marshal()

Defensive patterns

Strategy: validation

Validate before calling

// strings must be length-delimited; just ensure value is a Go string set on the struct
if req.GetRequest() == nil && req.GetRecoveryStartTokenID() == "" { /* caller must set oneof */ }

Prevention

Set RecoveryStartTokenID as a plain string on the generated struct
Avoid proto type changes for existing field numbers
Regenerate code after proto edits; never edit .pb.go by hand
Validate payloads with protoc --decode_raw when debugging

When it happens

Trigger: Decoding bytes where tag 2 is encoded as varint/fixed instead of a length-delimited string — mismatched proto definitions or corrupted/manually-built payloads.

Common situations: Client/server built from different proto versions where RecoveryStartTokenID changed type or number; payload corruption; test fixtures with wrong bytes.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/3eb541e7faa6cc26. Report an issue: GitHub.