pinpoint-apm/pinpoint · warning

Authorization Error: {}

Error message

Authorization Error: {}

What it means

AuthInterceptor.preHandle fails authorization and calls writeJsonError, which logs "Authorization Error: {}" with the serialized JSON error and writes a JSON failure body (MapResponse with Result.FAIL) to the HttpServletResponse with the given unauthorized HTTP status. The message is the log line accompanying an HTTP 401-style rejection of an unauthenticated collector management/API request.

Source

Thrown at collector/src/main/java/com/navercorp/pinpoint/collector/manage/controller/AuthInterceptor.java:89

        }

        String password = request.getParameter("password");
        if (!this.password.equals(password)) {
            String jsonError = jsonError("not matched admin password");
            writeJsonError(response, HttpStatus.FORBIDDEN, jsonError);
            return false;
        }

        return true;
    }

    private String jsonError(String errorMessage) throws JsonProcessingException {
        MapResponse response = new MapResponse(Result.FAIL, errorMessage);
        return mapper.writeValueAsString(response);
    }

    private void writeJsonError(HttpServletResponse response, HttpStatus unauthorized, String jsonError) throws IOException {
        logger.warn("Authorization Error: {}", jsonError);

        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        response.setStatus(unauthorized.value());
        response.getWriter().write(jsonError);
    }


    @Override
    public String toString() {
        return "AuthInterceptor{" +
                "password='" + password + '\'' +
                ", isActive=" + isActive +
                '}';
    }
}

View on GitHub (pinned to 744c3d3075)

Solutions

1. Inspect the logged jsonError body to see the specific failure reason returned to the client
2. Supply valid credentials/API key in the request (Authorization header) as configured on the collector
3. Verify the collector's auth configuration (enabled flag, expected key) matches what the client sends
4. Check for reverse proxies or gateways stripping or mangling the Authorization header

Example fix

// before
curl http://collector:8080/manage/agentInfo
// after
curl -H "Authorization: Bearer <valid-api-key>" http://collector:8080/manage/agentInfo

if (authHeader == null || !authHeader.startsWith("Bearer ")) {
    // fail fast client-side before calling the collector API
    throw new IllegalArgumentException("Authorization header with a valid API key is required");
}

boolean isAuthorized(String authHeader) {
    return authHeader != null && !authHeader.isBlank() && authHeader.startsWith("Bearer ");
}

Response resp = client.newCall(request).execute();
if (resp.code() == 401) {
    String body = resp.body().string(); // JSON MapResponse with failure reason
    throw new AuthenticationException("Collector rejected credentials: " + body);
}

When it happens

Trigger: A client request to a collector management endpoint fails preHandle authentication (missing/invalid API key or credentials); the interceptor then serializes a JSON error and returns it with the unauthorized status while logging this warning.

Common situations: Collector REST API called without an Authorization header; wrong or expired API key in client config; a proxy stripping auth headers; internal service hitting an auth-enabled collector unexpectedly.

Related errors

• RuntimeException wrapping Exception from getStatusCode
• Could not load User information.
• Timed out while getting serviceUid. serviceName:${serviceNam
• Failed to get serviceUid. serviceName:${serviceName}
• OtlpTraceParseException (syntax error, message built from sy

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/af9d8fd77bf0946d. Report an issue: GitHub.