What causes "unsupported auth: %s" in micro/go-micro?

Check the provider name spelling against the registered plugin key.

unsupported auth: %s

Error message

unsupported auth: %s

What it means

The CLI rejects a --auth value with no matching entry in c.opts.Auths, the map of auth providers registered by imported plugin packages. The Before hook returns the error and the command exits without running.

Source

Thrown at cmd/cmd.go:481

	if len(ctx.String("auth_id")) > 0 || len(ctx.String("auth_secret")) > 0 {
		authOpts = append(authOpts, auth.Credentials(
			ctx.String("auth_id"), ctx.String("auth_secret"),
		))
	}
	if len(ctx.String("auth_public_key")) > 0 {
		authOpts = append(authOpts, auth.PublicKey(ctx.String("auth_public_key")))
	}
	if len(ctx.String("auth_private_key")) > 0 {
		authOpts = append(authOpts, auth.PrivateKey(ctx.String("auth_private_key")))
	}
	if len(ctx.String("auth_namespace")) > 0 {
		authOpts = append(authOpts, auth.Namespace(ctx.String("auth_namespace")))
	}
	if name := ctx.String("auth"); len(name) > 0 {
		r, ok := c.opts.Auths[name]
		if !ok {
			return fmt.Errorf("unsupported auth: %s", name)
		}

		*c.opts.Auth = r(authOpts...)
	}

	// Set the registry
	if name := ctx.String("registry"); len(name) > 0 && (*c.opts.Registry).String() != name {
		r, ok := c.opts.Registries[name]
		if !ok {
			return fmt.Errorf("registry %q is not linked into this binary: import go-micro.dev/v6/cmd/defaults to enable flag-selected plugins", name)
		}

		sopts, clopts := c.setRegistry(r())
		serverOpts = append(serverOpts, sopts...)
		clientOpts = append(clientOpts, clopts...)
	}

	// Set the debug profile

View on GitHub (pinned to 24529f1404)

Solutions

Check the provider name spelling against the registered plugin key.
Import the auth plugin package (e.g. _ "go-micro.dev/v6/plugins/auth/jwt") or go-micro.dev/v6/cmd/defaults and rebuild.
Omit --auth to use the default auth implementation.
Set --auth_namespace and related flags only after the provider is linked.

Example fix

// before
micro --auth jwt new helloworld
// after: main.go
import _ "go-micro.dev/v6/plugins/auth/jwt"
// then:
micro --auth jwt new helloworld

Defensive patterns

Strategy: validation

Validate before calling

allowedAuth := map[string]bool{"": true, "jwt": true /* linked providers */}
if !allowedAuth[*authFlag] {
    return fmt.Errorf("auth provider %q not linked into this binary", *authFlag)
}

Try / catch

if err := c.Run(ctx); err != nil {
    if strings.HasPrefix(err.Error(), "unsupported auth:") {
        return fmt.Errorf("%w (import the auth plugin, e.g. plugins/auth/jwt)", err)
    }
    return err
}

Prevention

Match --auth values to auth plugin packages actually imported in main.go.
Keep auth provider name strings in version-controlled config, reviewed with the build.
After upgrades, confirm plugin registered names haven't changed.

When it happens

Trigger: Passing --auth jwt (or aws, oauth2, etc.) when the corresponding auth provider package was never imported into the binary, or the provider key is misspelled.

Common situations: Following service auth examples without linking the auth plugin; a stripped/minimal micro build; moving from the default no-op auth to a provider and forgetting the import.

Related errors

AI-assisted analysis of micro/go-micro@24529f1404 (2026-09-01). Data as JSON: /api/errors/5d03cf9786f18032. Report an issue: GitHub.