router-for-me/CLIProxyAPI · error

plugin store resolved basic auth is incomplete

Error message

plugin store resolved basic auth is incomplete

What it means

The resolved-auth applier rejects basic auth when either Username or Password in ResolvedAuthConfig is empty. Both halves of the credential must be present before the Authorization: Basic header is built; the code also scrubs the intermediate credential buffer after encoding.

Source

Thrown at internal/pluginstore/auth.go:285

		headers.Set("Authorization", "Bearer "+token)
	default:
		return false, fmt.Errorf("unsupported plugin store auth type %q", item.Type)
	}
	return true, nil
}

func applyResolvedPluginStoreAuth(headers http.Header, item ResolvedAuthConfig) (bool, error) {
	switch strings.ToLower(strings.TrimSpace(item.Type)) {
	case "", AuthTypeNone:
		return false, nil
	case AuthTypeBearer, AuthTypeGitHubToken:
		if len(item.Token) == 0 {
			return false, fmt.Errorf("plugin store resolved auth token is empty")
		}
		headers.Set("Authorization", "Bearer "+string(item.Token))
	case AuthTypeBasic:
		if len(item.Username) == 0 || len(item.Password) == 0 {
			return false, fmt.Errorf("plugin store resolved basic auth is incomplete")
		}
		credential := make([]byte, 0, len(item.Username)+1+len(item.Password))
		credential = append(credential, item.Username...)
		credential = append(credential, ':')
		credential = append(credential, item.Password...)
		encoded := base64.StdEncoding.EncodeToString(credential)
		for index := range credential {
			credential[index] = 0
		}
		headers.Set("Authorization", "Basic "+encoded)
	case AuthTypeHeader:
		if strings.TrimSpace(item.HeaderName) == "" {
			return false, fmt.Errorf("plugin store resolved auth missing header-name")
		}
		if len(item.HeaderValue) == 0 {
			return false, fmt.Errorf("plugin store resolved auth header value is empty")
		}
		headers.Set(item.HeaderName, string(item.HeaderValue))

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Provide both username and password in the resolved basic auth config
2. Check that both referenced secrets/env vars exist and resolve to non-empty values
3. If one side is genuinely unused, switch to an auth type that matches reality (e.g. header or bearer) instead of basic

Example fix

# before
{"auth": {"type": "basic", "username": "alice"}}

# after
{"auth": {"type": "basic", "username": "alice", "password": "<resolved-password>"}}

if strings.EqualFold(strings.TrimSpace(item.Type), "basic") {
    if len(item.Username) == 0 || len(item.Password) == 0 {
        return fmt.Errorf("basic auth requires both username and password")
    }
}

When it happens

Trigger: A resolved store auth of type basic with a missing username or password: partial secret materialization, only one of the two referenced secrets resolving, or a management API payload containing just one field.

Common situations: Secret store holding username but the password entry was rotated/deleted; management updates that set username only; username/password resolution env vars where one is unset at resolution time.

Related errors

• plugin store resolved auth token is empty
• plugin store auth missing header-name
• unsupported plugin store auth type %q
• plugin store resolved auth missing header-name
• plugin store resolved auth header value is empty

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/d55a2f63ee0ca2dc. Report an issue: GitHub.