signalapp/Signal-Server · error · InvalidAuthorizationHeaderException

Unsupported authorization method:

Error message

Unsupported authorization method: 

What it means

fromString throws InvalidAuthorizationHeaderException("Unsupported authorization method: <type>") when the scheme before the first space is not exactly "Basic" (case-sensitive). The parser only supports Basic authentication.

Solutions

1. Use scheme 'Basic' exactly with base64(username:password) credentials
2. Switch to the appropriate auth mechanism the endpoint expects (e.g. unidentified access key or token auth)
3. Fix client config to use account + password rather than a bearer token

Example fix

// before
Authorization: Bearer eyJhbGci...
// after
Authorization: Basic " + base64("+15551234567.1:password")

String scheme = header.substring(0, header.indexOf(' '));
if (!"Basic".equals(scheme)) throw new IllegalArgumentException("expected Basic scheme, got " + scheme);

try { BasicAuthorizationHeader.fromString(header); } catch (InvalidAuthorizationHeaderException e) { throw new NotAuthorizedException("Basic"); }

When it happens

Trigger: Sending "Bearer <token>", "basic ..." (lowercase), or any other scheme to an endpoint authenticated by BasicAuthorizationHeader.

Common situations: Clients configured for token/bearer auth hitting a basic-auth endpoint; case-sensitivity issues; using a session token where username/password are required.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Blank header
• Invalid authorization header:
• Missing credentials
• Bad decoded value:
• Badly-formatted credentials:

AI-assisted analysis of signalapp/Signal-Server@100ab61c82 (2026-09-09). Data as JSON: /api/errors/af19631595310f8d. Report an issue: GitHub.

Appendix: source

Thrown at service/src/main/java/org/whispersystems/textsecuregcm/auth/BasicAuthorizationHeader.java:38

    this.password = password;
  }

  public static BasicAuthorizationHeader fromString(final String header) throws InvalidAuthorizationHeaderException {
    try {
      if (StringUtils.isBlank(header)) {
        throw new InvalidAuthorizationHeaderException("Blank header");
      }

      final int spaceIndex = header.indexOf(' ');

      if (spaceIndex == -1) {
        throw new InvalidAuthorizationHeaderException("Invalid authorization header: " + header);
      }

      final String authorizationType = header.substring(0, spaceIndex);

      if (!"Basic".equals(authorizationType)) {
        throw new InvalidAuthorizationHeaderException("Unsupported authorization method: " + authorizationType);
      }

      final String credentials;

      try {
        credentials = new String(Base64.getDecoder().decode(header.substring(spaceIndex + 1)));
      } catch (final IndexOutOfBoundsException e) {
        throw new InvalidAuthorizationHeaderException("Missing credentials");
      }

      if (StringUtils.isEmpty(credentials)) {
        throw new InvalidAuthorizationHeaderException("Bad decoded value: " + credentials);
      }

      final int credentialSeparatorIndex = credentials.indexOf(':');

      if (credentialSeparatorIndex == -1) {
        throw new InvalidAuthorizationHeaderException("Badly-formatted credentials: " + credentials);

View on GitHub (pinned to 100ab61c82)