basic_auth auth strategy requires a string user

Error message

basic_auth auth strategy requires a string user

What it means

The auth strategy factory tried to build the basic_auth strategy, but the 'user' key in the strategy's config map is either absent or not a Go string. The type assertion config["user"].(string) failed, so no strategy could be constructed.

Solutions

Add a string "user" field to the basic_auth config
Quote numeric-looking usernames in YAML
Rename "username"/"login" keys to exactly "user"
Check that "password" is also a string, since that check follows

Example fix

// before
auth: {type: basic_auth, username: alice, password: "s3cret"}
// after
auth: {type: basic_auth, user: alice, password: "s3cret"}

Defensive patterns

Strategy: validation

Validate before calling

// Go: check basic_auth user before building
func validateBasicAuthUser(cfg map[string]interface{}) error {
	if _, ok := cfg["user"].(string); !ok {
		return errors.New("basic_auth requires a string user")
	}
	if _, ok := cfg["password"].(string); !ok {
		return errors.New("basic_auth requires a string password")
	}
	return nil
}

Type guard

func hasBasicAuthUser(cfg map[string]interface{}) bool {
	_, ok := cfg["user"].(string)
	return ok
}

Try / catch

b, err := request.NewBuilder(cfg)
if err != nil {
	if strings.Contains(err.Error(), "basic_auth") {
		return fmt.Errorf("basic_auth config must have string 'user' and 'password'")
	}
	return err
}

Prevention

Use the key "user", not "username"
Quote numeric usernames in YAML
Validate config against the Kratos JSON schema in CI
Keep auth blocks consistent when migrating between api_key and basic_auth

When it happens

Trigger: basic_auth auth config without a "user" key, or "user" of a non-string type (number, bool, null) — e.g. YAML user: 42 or user: true.

Common situations: Numeric usernames parsed as integers in YAML; partially migrated configs still carrying api_key's name/value keys; typos like "username" instead of "user".

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/4750b28d6a7ae764. Report an issue: GitHub.

Appendix: source

Thrown at request/auth.go:47

func authStrategy(typ string, config map[string]any) (AuthStrategy, error) {
	switch typ {
	case "":
		return NewNoopAuthStrategy(), nil
	case "api_key":
		name, ok := config["name"].(string)
		if !ok {
			return nil, fmt.Errorf("api_key auth strategy requires a string name")
		}
		value, ok := config["value"].(string)
		if !ok {
			return nil, fmt.Errorf("api_key auth strategy requires a string value")
		}
		in, _ := config["in"].(string) // in is optional
		return NewAPIKeyStrategy(in, name, value), nil
	case "basic_auth":
		user, ok := config["user"].(string)
		if !ok {
			return nil, fmt.Errorf("basic_auth auth strategy requires a string user")
		}
		password, ok := config["password"].(string)
		if !ok {
			return nil, fmt.Errorf("basic_auth auth strategy requires a string password")
		}
		return NewBasicAuthStrategy(user, password), nil
	}

	return nil, fmt.Errorf("unsupported auth type: %s", typ)
}

func NewNoopAuthStrategy() AuthStrategy {
	return &noopAuthStrategy{}
}

func (c *noopAuthStrategy) apply(_ *retryablehttp.Request) {}

func NewBasicAuthStrategy(user, password string) AuthStrategy {

View on GitHub (pinned to b86338da04)