grpc-ecosystem/grpc-gateway · error

malformed security requirement spec for key %q; value is req

Error message

malformed security requirement spec for key %q; value is required

What it means

Spec-validation error in renderServices while converting google.api SecurityRequirement protos: a security requirement map entry has a nil value, but the OpenAPI spec requires each scheme key to map to a (possibly empty) list of scopes. The offending input is the SecurityRequirement in the openapiv2 options whose value was not set.

Source

Thrown at protoc-gen-openapiv2/internal/genopenapi/template.go:2533

					exts, err := processExtensions(secDefValue.Extensions)
					if err != nil {
						return nil, err
					}
					newSecDefValue.extensions = exts
				}
				s.SecurityDefinitions[secDefKey] = newSecDefValue
			}
		}
		if spb.Security != nil {
			var newSecurity []openapiSecurityRequirementObject
			if s.Security != nil {
				newSecurity = s.Security
			}
			for _, secReq := range spb.Security {
				newSecReq := openapiSecurityRequirementObject{}
				for secReqKey, secReqValue := range secReq.SecurityRequirement {
					if secReqValue == nil {
						return nil, fmt.Errorf("malformed security requirement spec for key %q; value is required", secReqKey)
					}
					newSecReqValue := make([]string, len(secReqValue.Scope))
					copy(newSecReqValue, secReqValue.Scope)
					newSecReq[secReqKey] = newSecReqValue
				}
				newSecurity = append(newSecurity, newSecReq)
			}
			s.Security = newSecurity
		}
		s.ExternalDocs = protoExternalDocumentationToOpenAPIExternalDocumentation(spb.ExternalDocs, p.reg, spb)
		// Populate all Paths with Responses set at top level,
		// preferring Responses already set over those at the top level.
		if spb.Responses != nil {
			for _, verbs := range s.Paths {
				var maps []openapiResponsesObject
				if verbs.PathItemObject.Delete != nil {
					maps = append(maps, verbs.PathItemObject.Delete.Responses)
				}

View on GitHub (pinned to a58a4436a3)

Solutions

1. Set an (optionally empty) scopes list for every key in the security requirement.
2. Remove the empty entry from the openapiv2_security options if the scheme is not needed.

When it happens

Trigger: Thrown at protoc-gen-openapiv2/internal/genopenapi/template.go:2533 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of grpc-ecosystem/grpc-gateway@a58a4436a3 (2026-09-02). Data as JSON: /api/errors/dac30aa1947598a3. Report an issue: GitHub.