ory/hydra · error

unsupported auth type %q

Error message

unsupported auth type %q

What it means

applyAuth applies authentication material to an outgoing token hook request. It supports api_key (header/cookie), client_basic, and client_secret_bearer style auth; when auth.Type matches none of the known types the switch's default branch returns this error with the offending type name.

Source

Thrown at oauth2/token_hook.go:87

	Name  string `json:"name"`
	Value string `json:"value"`
}

func applyAuth(req *retryablehttp.Request, auth *config.Auth) error {
	if auth == nil {
		return nil
	}

	switch auth.Type {
	case "api_key":
		switch auth.Config.In {
		case "header":
			req.Header.Set(auth.Config.Name, auth.Config.Value)
		case "cookie":
			req.AddCookie(&http.Cookie{Name: auth.Config.Name, Value: auth.Config.Value})
		}
	default:
		return errors.Errorf("unsupported auth type %q", auth.Type)
	}
	return nil
}

func executeHookAndUpdateSession(ctx context.Context, reg httpx.ClientProvider, hookConfig *config.HookConfig, reqBodyBytes []byte, session *Session) error {
	req, err := retryablehttp.NewRequestWithContext(ctx, http.MethodPost, hookConfig.URL, bytes.NewReader(reqBodyBytes))
	if err != nil {
		return errors.WithStack(
			fosite.ErrServerError.
				WithWrap(err).
				WithDescription("An error occurred while preparing the token hook.").
				WithDebugf("Unable to prepare the HTTP Request: %s", err),
		)
	}
	if err := applyAuth(req, hookConfig.Auth); err != nil {
		return errors.WithStack(
			fosite.ErrServerError.
				WithWrap(err).

View on GitHub (pinned to 4174065ffb)

Solutions

1. Set auth.type to a supported value (e.g. api_key with auth.config.type header/cookie, client_basic, client_secret_bear)
2. Check for typos/casing in the auth.type config field
3. Validate the hook configuration against the HookConfig schema before deploying
4. If you need a new auth type, extend the switch in oauth2/token_hook.go applyAuth

Example fix

// before
auth:
  type: api-key
// after
auth:
  type: api_key
  config:
    type: header
    name: X-API-Key
    value: secret

var validAuthTypes = map[string]bool{"api_key": true, "client_basic": true, "client_secret_bear": true}
if hook.Auth != nil && !validAuthTypes[hook.Auth.Type] {
    return fmt.Errorf("hook auth.type %q not supported", hook.Auth.Type)
}

When it happens

Trigger: Configuring an OAuth2 token hook with auth.type set to a value other than the supported ones (e.g. a typo like 'headers', 'api-key', or a new unsupported type), then triggering a token hook request during a token/refresh/code exchange.

Common situations: Typo or wrong casing in the hook configuration (auth.type); copying config from another product with different auth type names; a config schema migration that renamed the allowed values.

Related errors

• http(s) loader disabled
• secret for signing HMAC-SHA512/256 is expected to be 32 byte
• device_challenge is required
• issuer URL must be set unless development mode is enabled
• issuer URL scheme must be HTTPS unless development mode is e

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/1207f5e04fd9ffd0. Report an issue: GitHub.