basic_auth auth strategy requires a string password

Error message

basic_auth auth strategy requires a string password

What it means

The auth strategy factory was building the basic_auth strategy and the 'user' field passed validation, but the 'password' key in the config map is missing or not a Go string. The type assertion config["password"].(string) failed, aborting strategy construction.

Solutions

Quote the password in YAML: password: "12345678"
Set the password key explicitly (not value) for basic_auth
Verify the env var backing the password is set and non-empty
Confirm "user" is a string too, since the earlier check would fail first

Example fix

// before
auth:
  type: basic_auth
  user: alice
  password: 12345678
// after
auth:
  type: basic_auth
  user: alice
  password: "12345678"

Defensive patterns

Strategy: validation

Validate before calling

// Go: check basic_auth password before building
func validateBasicAuthPassword(cfg map[string]interface{}) error {
	p, ok := cfg["password"].(string)
	if !ok || p == "" {
		return errors.New("basic_auth requires a non-empty string password")
	}
	return nil
}

Type guard

func hasBasicAuthPassword(cfg map[string]interface{}) bool {
	p, ok := cfg["password"].(string)
	return ok && p != ""
}

Try / catch

b, err := request.NewBuilder(cfg)
if err != nil {
	if strings.Contains(err.Error(), "requires a string password") {
		return fmt.Errorf("quote the basic_auth password in YAML so it is a string")
	}
	return err
}

Prevention

Always quote passwords, especially digit-only ones
Use the key "password", not "value" or "pass"
Check secret env substitution produces a non-empty string
Lint config files with a YAML parser that reports coercion

When it happens

Trigger: basic_auth auth config without "password", or a non-string password (unquoted all-digit password parsed as int, bool, object, null).

Common situations: Passwords made only of digits parsed as YAML integers; env templating producing empty/null; moving from api_key to basic_auth without renaming value -> password.

Related errors

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/eeee0133af45958b. Report an issue: GitHub.

Appendix: source

Thrown at request/auth.go:51

	case "api_key":
		name, ok := config["name"].(string)
		if !ok {
			return nil, fmt.Errorf("api_key auth strategy requires a string name")
		}
		value, ok := config["value"].(string)
		if !ok {
			return nil, fmt.Errorf("api_key auth strategy requires a string value")
		}
		in, _ := config["in"].(string) // in is optional
		return NewAPIKeyStrategy(in, name, value), nil
	case "basic_auth":
		user, ok := config["user"].(string)
		if !ok {
			return nil, fmt.Errorf("basic_auth auth strategy requires a string user")
		}
		password, ok := config["password"].(string)
		if !ok {
			return nil, fmt.Errorf("basic_auth auth strategy requires a string password")
		}
		return NewBasicAuthStrategy(user, password), nil
	}

	return nil, fmt.Errorf("unsupported auth type: %s", typ)
}

func NewNoopAuthStrategy() AuthStrategy {
	return &noopAuthStrategy{}
}

func (c *noopAuthStrategy) apply(_ *retryablehttp.Request) {}

func NewBasicAuthStrategy(user, password string) AuthStrategy {
	return &basicAuthStrategy{
		user:     user,
		password: password,
	}

View on GitHub (pinned to b86338da04)