router-for-me/CLIProxyAPI · error

unsupported plugin store resolved auth type %q

Error message

unsupported plugin store resolved auth type %q

What it means

The auth applier in internal/pluginstore/auth.go hit its default case: the resolved auth entry's Type string is not one of none, bearer, basic, header, or github-token. The switch cannot guess how to authenticate the request, so it refuses rather than sending an unauthenticated call. Almost always a typo or a version mismatch where config uses a type this build does not know.

Source

Thrown at internal/pluginstore/auth.go:305

		credential := make([]byte, 0, len(item.Username)+1+len(item.Password))
		credential = append(credential, item.Username...)
		credential = append(credential, ':')
		credential = append(credential, item.Password...)
		encoded := base64.StdEncoding.EncodeToString(credential)
		for index := range credential {
			credential[index] = 0
		}
		headers.Set("Authorization", "Basic "+encoded)
	case AuthTypeHeader:
		if strings.TrimSpace(item.HeaderName) == "" {
			return false, fmt.Errorf("plugin store resolved auth missing header-name")
		}
		if len(item.HeaderValue) == 0 {
			return false, fmt.Errorf("plugin store resolved auth header value is empty")
		}
		headers.Set(item.HeaderName, string(item.HeaderValue))
	default:
		return false, fmt.Errorf("unsupported plugin store resolved auth type %q", item.Type)
	}
	return true, nil
}

func validatePluginStoreRequestURL(auth []AuthConfig, requestURL string, kind string) error {
	parsed, errParse := url.Parse(strings.TrimSpace(requestURL))
	if errParse != nil || parsed.Scheme == "" || parsed.Host == "" {
		return fmt.Errorf("invalid plugin store url")
	}
	if parsed.User != nil {
		return fmt.Errorf("plugin store url must not contain credentials")
	}
	if hasSensitiveQueryParameter(parsed) {
		return fmt.Errorf("plugin store url contains sensitive query parameter")
	}
	if strings.EqualFold(parsed.Scheme, "http") && !allowInsecurePluginStoreURL(auth, requestURL, kind) {
		return fmt.Errorf("insecure plugin store url requires matching allow-insecure auth rule")
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Change type to one of: none, bearer, basic, header, github-token
2. Check for trailing spaces/quotes around the type value in YAML
3. Verify against the version's config.example.yaml which auth types this build supports

Example fix

# before
- match: https://plugins.example.com
  type: apikey
  token-env: PLUGIN_TOKEN

# after
- match: https://plugins.example.com
  type: bearer
  token-env: PLUGIN_TOKEN

var validAuthTypes = map[string]bool{"none": true, "bearer": true, "basic": true, "header": true, "github-token": true}

func authTypeValid(t string) bool { return validAuthTypes[strings.ToLower(strings.TrimSpace(t))] }

When it happens

Trigger: A matching auth rule has type: apikey (or 'Bearer ' with trailing space and different casing after normalization failure, or any unsupported string) and a request hits applyResolvedAuth for that rule.

Common situations: Typo in config.yaml (apikey vs header); config written for a newer/older CLIProxyAPI version with different type names; copied auth block from another tool (e.g. npm registry auth syntax) into plugin-store config.

Related errors

• plugin store auth missing header-name
• unsupported plugin store auth type %q
• plugin store resolved auth token is empty
• plugin store resolved basic auth is incomplete
• plugin store resolved auth missing header-name

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/e9dfea61f95844eb. Report an issue: GitHub.