ory/kratos · error

unsupported auth type

Error message

unsupported auth type: %s

What it means

authStrategy switches on the auth "type" field and returns a strategy for "" (noop), "api_key", and "basic_auth". Any other type string reaches the fallthrough and produces this error, failing NewBuilder. Note the type must also be a string in the config map.

Solutions

1. Set type to one of: "" (no auth), "api_key", or "basic_auth"
2. Fix typos: "apikey" -> "api_key", "basicauth" -> "basic_auth"
3. Remove the auth block entirely if no authentication is needed
4. Check the library version's supported strategies — newer ones may add types

Example fix

// before
auth:
  type: bearer
  token: abc
// after
auth:
  type: api_key
  in: header
  name: Authorization
  value: "Bearer abc"

// Go: check auth type against supported set before building
var supportedAuthTypes = map[string]bool{"": true, "api_key": true, "basic_auth": true}
func validateAuthType(cfg map[string]interface{}) error {
	typ, _ := cfg["type"].(string)
	if !supportedAuthTypes[typ] {
		return fmt.Errorf("unsupported auth type %q; use '', 'api_key', or 'basic_auth'", typ)
	}
	return nil
}

func isSupportedAuthType(cfg map[string]interface{}) bool {
	typ, _ := cfg["type"].(string)
	return typ == "" || typ == "api_key" || typ == "basic_auth"
}

b, err := request.NewBuilder(cfg)
if err != nil {
	var unsupportedErr interface{ Error() string }
	if strings.HasPrefix(err.Error(), "unsupported auth type") {
		return fmt.Errorf("check auth.type spelling; supported: '', api_key, basic_auth")
	}
	return err
}

When it happens

Trigger: Webhook auth config with type set to an unrecognized value such as "bearer", "oauth2", "digest", or a typo like "apikey" / "basicauth".

Common situations: Copying auth config from another webhook product that supports bearer tokens; typos in the type string; assuming OAuth is supported when it isn't in this version.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• no credentials found
• api_key auth strategy requires a string name
• api_key auth strategy requires a string value
• basic_auth auth strategy requires a string user
• basic_auth auth strategy requires a string password

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/13f59f93354d86c6. Report an issue: GitHub.

Appendix: source

Thrown at request/auth.go:56

		value, ok := config["value"].(string)
		if !ok {
			return nil, fmt.Errorf("api_key auth strategy requires a string value")
		}
		in, _ := config["in"].(string) // in is optional
		return NewAPIKeyStrategy(in, name, value), nil
	case "basic_auth":
		user, ok := config["user"].(string)
		if !ok {
			return nil, fmt.Errorf("basic_auth auth strategy requires a string user")
		}
		password, ok := config["password"].(string)
		if !ok {
			return nil, fmt.Errorf("basic_auth auth strategy requires a string password")
		}
		return NewBasicAuthStrategy(user, password), nil
	}

	return nil, fmt.Errorf("unsupported auth type: %s", typ)
}

func NewNoopAuthStrategy() AuthStrategy {
	return &noopAuthStrategy{}
}

func (c *noopAuthStrategy) apply(_ *retryablehttp.Request) {}

func NewBasicAuthStrategy(user, password string) AuthStrategy {
	return &basicAuthStrategy{
		user:     user,
		password: password,
	}
}

func (c *basicAuthStrategy) apply(req *retryablehttp.Request) {
	req.SetBasicAuth(c.user, c.password)
}

View on GitHub (pinned to b86338da04)