grpc/grpc-go · error

no alts.AuthInfo found in Peer

Error message

no alts.AuthInfo found in Peer

What it means

Returned by AuthInfoFromPeer (credentials/alts/utils.go:46-51) when the Peer exists but its AuthInfo field is not of type alts.AuthInfo — the type assertion p.AuthInfo.(AuthInfo) at utils.go:47 fails. The connection was established with non-ALTS credentials (TLS, insecure, etc.), so there is no ALTS auth info to extract.

Source

Thrown at credentials/alts/utils.go:49

// AuthInfoFromContext extracts the alts.AuthInfo object from the given context,
// if it exists. This API should be used by gRPC server RPC handlers to get
// information about the communicating peer. For client-side, use grpc.Peer()
// CallOption.
func AuthInfoFromContext(ctx context.Context) (AuthInfo, error) {
	p, ok := peer.FromContext(ctx)
	if !ok {
		return nil, errors.New("no Peer found in Context")
	}
	return AuthInfoFromPeer(p)
}

// AuthInfoFromPeer extracts the alts.AuthInfo object from the given peer, if it
// exists. This API should be used by gRPC clients after obtaining a peer object
// using the grpc.Peer() CallOption.
func AuthInfoFromPeer(p *peer.Peer) (AuthInfo, error) {
	altsAuthInfo, ok := p.AuthInfo.(AuthInfo)
	if !ok {
		return nil, errors.New("no alts.AuthInfo found in Peer")
	}
	return altsAuthInfo, nil
}

// ClientAuthorizationCheck checks whether the client is authorized to access
// the requested resources based on the given expected client service accounts.
// This API should be used by gRPC server RPC handlers. This API should not be
// used by clients.
func ClientAuthorizationCheck(ctx context.Context, expectedServiceAccounts []string) error {
	authInfo, err := AuthInfoFromContext(ctx)
	if err != nil {
		return status.Errorf(codes.PermissionDenied, "The context is not an ALTS-compatible context: %v", err)
	}
	peer := authInfo.PeerServiceAccount()
	for _, sa := range expectedServiceAccounts {
		if strings.EqualFold(peer, sa) {
			return nil
		}

View on GitHub (pinned to 03255a9237)

Solutions

1. Ensure the server uses ALTS creds: grpc.NewServer(grpc.Creds(alts.NewServerCreds(opts))) and the client uses alts.NewClientCreds(...).
2. Before extracting ALTS info, type-check p.AuthInfo: if _, ok := p.AuthInfo.(alts.AuthInfo); !ok { /* not an ALTS conn */ }.
3. If you must support both TLS and ALTS, branch on the AuthInfo type rather than assuming ALTS.
4. Use ClientAuthorizationCheck which converts this into codes.PermissionDenied for a clean failure.

Example fix

// before — server runs TLS but handler expects ALTS
srv := grpc.NewServer(grpc.Creds(credentials.NewTLS(tlsConf)))
// in handler: alts.AuthInfoFromContext(ctx) -> no alts.AuthInfo found in Peer

// after — match creds to the auth check
srv := grpc.NewServer(grpc.Creds(alts.NewServerCreds(opts)))
// or branch on type
switch ai := p.AuthInfo.(type) {
case alts.AuthInfo:  _ = ai
case credentials.TLSInfo: _ = ai
}

// Branch on AuthInfo type so non-ALTS connections are handled, not errored
switch ai := p.AuthInfo.(type) {
case alts.AuthInfo:    use(ai)
case credentials.TLSInfo: useTLS(ai)
default:               return status.Error(codes.PermissionDenied, "unsupported creds")
}

func isALTSAuthInfo(ai credentials.AuthInfo) bool {
    _, ok := ai.(alts.AuthInfo)
    return ok
}

if _, err := alts.AuthInfoFromPeer(p); err != nil {
    if strings.Contains(err.Error(), "no alts.AuthInfo found") {
        // connection is not ALTS; either switch to ALTS creds or branch by type
    }
}

When it happens

Trigger: AuthInfoFromPeer/AuthInfoFromContext is called on a Peer whose AuthInfo is a TLSInfo (or other type) because the channel/server used TLS or insecure credentials instead of ALTS. The assertion at utils.go:47 returns ok==false.

Common situations: Server handler using alts.ClientAuthorizationCheck while the server was started with grpc.Creds(credentials.NewTLS(...)); client switched from ALTS to TLS but auth code still calls AuthInfoFromPeer; mixed-credential deployments where some connections are TLS.

Related errors

• no Peer found in Context
• grpc: no transport security set (use grpc.WithTransportCrede
• grpc: credentials.Bundle may not be used with individual Tra
• grpc: credentials.Bundle must return non-nil transport crede
• grpc: the credentials require transport level security (use

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/63d7a117e2b9212f. Report an issue: GitHub.