Kafka Error DELEGATION_TOKEN_AUTH_DISABLED
Error code 61 · Non-retriable Security
Delegation Token feature is not enabled.
Common Causes
- `delegation.token.master.key` is not configured in `server.properties`
- Broker was restarted with delegation token config removed, disabling the feature cluster-wide
- Client is attempting token-based auth against a broker that only supports PLAINTEXT or mTLS without token configuration
Solutions
- Add `delegation.token.master.key=<secret>` to `server.properties` on all brokers and rolling-restart the cluster to enable delegation tokens
- Ensure all brokers in the cluster have the same `delegation.token.master.key` value — inconsistency causes tokens to validate on some brokers but not others
- If delegation tokens are not needed, switch clients to use SASL/SCRAM or Kerberos directly instead
Diagnostic Commands
# Check delegation token config
grep 'delegation.token' /path/to/server.properties
# Check delegation token configuration
kafka-configs.sh --bootstrap-server localhost:9092 --entity-type brokers --entity-default --describe | grep delegationRelated APIs
This error can be returned by: DescribeDelegationToken
Debugging Kafka errors? Conduktor Console gives you real-time visibility into your cluster. Explore all errors in the Error Decoder.