kubernetes/kops · error

invalid authorization token

Error message

invalid authorization token

What it means

Format-validation sentinel in the DO verifier: after stripping the x-digitalocean-droplet-id prefix, the remaining token text is not a valid integer (strconv.Atoi failed), so the token cannot identify a droplet. Indicates a malformed bootstrap token rather than a bad credential per se.

Source

Thrown at upup/pkg/fi/cloudup/do/verifier.go:67

	}

	tokenSource := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})
	doClient := godo.NewClient(oauth2.NewClient(ctx, tokenSource))

	return &digitalOceanVerifier{
		doClient: doClient,
	}, nil
}

func (o digitalOceanVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, dometadata.DOAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}
	serverIDString := strings.TrimPrefix(token, dometadata.DOAuthenticationTokenPrefix)

	serverID, err := strconv.Atoi(serverIDString)
	if err != nil {
		return nil, fmt.Errorf("invalid authorization token")
	}

	droplet, _, err := o.doClient.Droplets.Get(ctx, serverID)
	if err != nil {
		return nil, fmt.Errorf("failed to get info for server %v: %w", token, err)
	}

	var addresses []string
	var challengeEndpoints []string
	if droplet.Networks != nil {
		for _, nic := range droplet.Networks.V4 {
			if nic.Type == "private" {
				addresses = append(addresses, nic.IPAddress)
				challengeEndpoints = append(challengeEndpoints, net.JoinHostPort(nic.IPAddress, strconv.Itoa(wellknownports.NodeupChallenge)))
			}
		}
		for _, nic := range droplet.Networks.V6 {
			if nic.Type == "private" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the token on the node (kops-controller/nodeup bootstrap)
2. Check that nodeup's CreateToken is producing the ID correctly
3. Report if tokens are consistently malformed

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/do/verifier.go:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d2cb0a69250dae44. Report an issue: GitHub.