nsqio/nsq · error

--auth-http-request-method must be post or get

Error message

--auth-http-request-method must be post or get

What it means

nsqd calls out to an external HTTP authentication endpoint when --auth-http-address is configured, using opts.AuthHTTPRequestMethod (--auth-http-request-method, default 'get'). Only the exact lowercase strings 'post' and 'get' are accepted; the check opts.AuthHTTPRequestMethod != "post" && != "get" is case-sensitive and aborts startup otherwise.

Source

Thrown at nsqd/nsqd.go:139

	}

	tlsConfig, err := buildTLSConfig(opts)
	if err != nil {
		return nil, fmt.Errorf("failed to build TLS config - %s", err)
	}
	if tlsConfig == nil && opts.TLSRequired != TLSNotRequired {
		return nil, errors.New("cannot require TLS client connections without TLS key and cert")
	}
	n.tlsConfig = tlsConfig

	clientTLSConfig, err := buildClientTLSConfig(opts)
	if err != nil {
		return nil, fmt.Errorf("failed to build client TLS config - %s", err)
	}
	n.clientTLSConfig = clientTLSConfig

	if opts.AuthHTTPRequestMethod != "post" && opts.AuthHTTPRequestMethod != "get" {
		return nil, errors.New("--auth-http-request-method must be post or get")
	}

	for _, v := range opts.E2EProcessingLatencyPercentiles {
		if v <= 0 || v > 1 {
			return nil, fmt.Errorf("invalid E2E processing latency percentile: %v", v)
		}
	}

	n.logf(LOG_INFO, version.String("nsqd"))
	n.logf(LOG_INFO, "ID: %d", opts.ID)

	n.tcpServer = &tcpServer{nsqd: n}
	n.tcpListener, err = net.Listen(util.TypeOfAddr(opts.TCPAddress), opts.TCPAddress)
	if err != nil {
		return nil, fmt.Errorf("listen (%s) failed - %s", opts.TCPAddress, err)
	}
	if opts.HTTPAddress != "" {
		n.httpListener, err = net.Listen(util.TypeOfAddr(opts.HTTPAddress), opts.HTTPAddress)

View on GitHub (pinned to 85cf10c09c)

Solutions

1. Use the lowercase literal: --auth-http-request-method=post (or get, the default - then omit the flag).
2. Lowercase the value in whatever generates nsqd's config.
3. Ensure your auth endpoint actually accepts that method for the /auth path before switching.

Example fix

# before
nsqd --auth-http-address=0.0.0.0:8080 --auth-http-request-method=POST
# after
nsqd --auth-http-address=0.0.0.0:8080 --auth-http-request-method=post

if m := strings.ToLower(strings.TrimSpace(opts.AuthHTTPRequestMethod)); m != "post" && m != "get" {
	return fmt.Errorf("invalid auth-http-request-method %q: must be post or get", opts.AuthHTTPRequestMethod)
}
opts.AuthHTTPRequestMethod = m // normalize before nsqd.New

When it happens

Trigger: Starting nsqd with --auth-http-request-method=POST (uppercase), 'PUT', 'DELETE', or a typo like 'GET ' with trailing whitespace. Any value other than exact 'post'/'get' fails in New() before the auth client is built.

Common situations: Uppercasing values in config templating (HTTP methods are conventionally uppercase, so YAML/ENV pipelines produce POST); hand-editing config files; mismatched expectations after upgrading from versions with different validation.

Related errors

• --max-deflate-level must be [1,9]
• --node-id must be [0,1024)
• cannot require TLS client connections without TLS key and ce
• address should not contain scheme
• missing <REV> in --filename-format when gzip, rotation, or w

AI-assisted analysis of nsqio/nsq@85cf10c09c (2026-08-16). Data as JSON: /api/errors/99a31bcbfb57d5a4. Report an issue: GitHub.