reactiveui/refit · error · ArgumentException

Only one parameter can be an Authorize parameter

Error message

Only one parameter can be an Authorize parameter

What it means

A method may declare at most one [Authorize]-style parameter (the authorization scheme carrier). The loop records the first authorize attribute and throws if a second authorize parameter is found. Multiple authorize parameters would produce conflicting scheme selection.

Source

Thrown at src/Refit.Reflection/RestMethodInfoInternal.AttributeReading.cs:240

    /// <param name="sets">The classified attribute set for each parameter.</param>
    /// <returns>The authorization parameter information, or null when there is no authorize parameter.</returns>
    /// <exception cref="ArgumentException">More than one parameter carries <see cref="AuthorizeAttribute"/>.</exception>
    internal static Tuple<string, int>? FindAuthorizationParameter(ParameterAttributeSet[] sets)
    {
        AuthorizeAttribute? authorizeAttribute = null;
        var authorizeIndex = -1;

        for (var i = 0; i < sets.Length; i++)
        {
            var attribute = sets[i].Authorize;
            if (attribute is null)
            {
                continue;
            }

            if (authorizeAttribute is not null)
            {
                throw new ArgumentException("Only one parameter can be an Authorize parameter");
            }

            authorizeAttribute = attribute;
            authorizeIndex = i;
        }

        return authorizeAttribute is null
            ? null
            : Tuple.Create(authorizeAttribute.Scheme, authorizeIndex);
    }
}

View on GitHub (pinned to b455f65ecc)

Solutions

1. Keep a single Authorize parameter per method and express additional credentials via [Header] or [Authorization] differently.
2. If two schemes are needed, resolve which one is authoritative and remove the second Authorize binding.

Example fix

// before
[Get("/me")] Task MeAsync([Authorize("Bearer")] string jwt,
                          [Authorize("Basic")] string basic);

// after
[Get("/me")] Task MeAsync([Authorize("Bearer")] string jwt);

static void AssertSingleAuthorize(MethodInfo m) {
    var count = m.GetParameters().Count(p => p.GetCustomAttribute<AuthorizeAttribute>() is not null);
    if (count > 1) throw new InvalidOperationException("Multiple Authorize params on " + m.Name);
}

When it happens

Trigger: Two parameters on the same method both carry the Authorize attribute (auth scheme binding).

Common situations: Adding a second auth parameter during a security refactor; mixing token + API-key auth as two Authorize params; copy-paste of an auth param.

Related errors

• Method must be defined and have an HTTP Method attribute
• HeaderCollection parameter of type {parameterArray[i].Parame
• Only one parameter can be a HeaderCollection parameter
• URL {relativePath} has parameter {rawName}, but no method pa
• A [Url] method must not also declare a path template; [Url]

AI-assisted analysis of reactiveui/refit@b455f65ecc (2026-08-13). Data as JSON: /api/errors/32ee0697070932f7. Report an issue: GitHub.