hashicorp/nomad · error

invalid token type '%s'

Error message

invalid token type '%s'

What it means

ACLAuthMethod.Validate() rejects Type because it is not in ValidACLAuthMethodTypes, which currently contains only "OIDC" and "JWT". Nomad only ships built-in support for these two auth method protocols.

Source

Thrown at nomad/structs/acl.go:1440

// Validate returns an error is the ACLAuthMethod is invalid.
//
// TODO revisit possible other validity conditions in the future
func (a *ACLAuthMethod) Validate(minTTL, maxTTL time.Duration) error {
	var mErr multierror.Error

	if !ValidACLAuthMethod.MatchString(a.Name) {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("invalid name '%s'", a.Name))
	}

	if !slices.Contains([]string{ACLAuthMethodTokenLocalityLocal, ACLAuthMethodTokenLocalityGlobal}, a.TokenLocality) {
		mErr.Errors = append(
			mErr.Errors, fmt.Errorf("invalid token locality '%s'", a.TokenLocality))
	}

	if !slices.Contains(ValidACLAuthMethodTypes, a.Type) {
		mErr.Errors = append(
			mErr.Errors, fmt.Errorf("invalid token type '%s'", a.Type))
	}

	if err := a.Config.Validate(a.Type); err != nil {
		mErr.Errors = append(mErr.Errors, fmt.Errorf("invalid config: %w", err))
	}

	if minTTL > a.MaxTokenTTL || a.MaxTokenTTL > maxTTL {
		mErr.Errors = append(mErr.Errors, fmt.Errorf(
			"invalid MaxTokenTTL value '%s' (should be between %s and %s)",
			a.MaxTokenTTL.String(), minTTL.String(), maxTTL.String()))
	}

	return mErr.ErrorOrNil()
}

// Sanitize returns a copy of the ACLAuthMethod with any secrets redacted
func (a *ACLAuthMethod) Sanitize() *ACLAuthMethod {
	if a == nil || a.Config == nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set Type to exactly "OIDC" or "JWT".
2. Use constants structs.ACLAuthMethodTypeOIDC / ACLAuthMethodTypeJWT instead of literals.
3. Check the Nomad version's ValidACLAuthMethodTypes if a newer type was expected; upgrade Nomad if needed.

Example fix

// before
am := &structs.ACLAuthMethod{Name: "okta", Type: "oidc"}
// after
am := &structs.ACLAuthMethod{Name: "okta", Type: structs.ACLAuthMethodTypeOIDC}

if !slices.Contains([]string{"OIDC","JWT"}, am.Type) {
	return fmt.Errorf("Type must be OIDC or JWT, got %q", am.Type)
}

func validAuthMethodType(t string) bool { return t == "OIDC" || t == "JWT" }

if err := am.Validate(minTTL, maxTTL); err != nil {
	if strings.Contains(err.Error(), "invalid token type") {
		return fmt.Errorf("check Type casing; supported: OIDC, JWT")
	}
	return err
}

When it happens

Trigger: Creating an auth method with Type like "jwt", "oidc", "HMAC", "SAML", or an empty string. The comparison is exact/uppercase-sensitive.

Common situations: Writing the type in lowercase in HCL/JSON config; assuming other HashiCorp-style types (e.g. Consul's 'jwt' providers) are supported; typos like 'OIDCS'.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• token name too long
• client token missing policies or roles
• management token cannot be associated with policies or roles
• token type must be client or management
• expiration time cannot be before create time

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/459acab3563fbd2e. Report an issue: GitHub.