HKUDS/nanobot · error · ValueError

missing token kid

Error message

missing token kid

What it means

Error "missing token kid" thrown in HKUDS/nanobot.

Source

Thrown at nanobot/channels/msteams/runtime.py:487

            return reply
        return quoted

    async def _validate_inbound_auth(self, auth_header: str, activity: dict[str, Any]) -> None:
        """Validate inbound Bot Framework bearer token."""
        if not MSTEAMS_AVAILABLE:
            raise RuntimeError("PyJWT not installed. Run: nanobot plugins enable msteams")

        if not auth_header.lower().startswith("bearer "):
            raise ValueError("missing bearer token")

        token = auth_header.split(" ", 1)[1].strip()
        if not token:
            raise ValueError("empty bearer token")

        header = jwt.get_unverified_header(token)
        kid = str(header.get("kid") or "").strip()
        if not kid:
            raise ValueError("missing token kid")

        jwks = await self._get_botframework_jwks()
        keys = cast(list[dict[str, Any]], jwks.get("keys") or [])
        jwk = next((key for key in keys if key.get("kid") == kid), None)
        if not jwk:
            raise ValueError(f"signing key not found for kid={kid}")

        public_key = RSAAlgorithm.from_jwk(json.dumps(jwk))
        claims = jwt.decode(
            token,
            key=cast(Any, public_key),
            algorithms=["RS256"],
            audience=self.config.app_id,
            issuer="https://api.botframework.com",
            options={
                "require": ["exp", "nbf", "iss", "aud"],
            },
        )

View on GitHub (pinned to 42f37dc4c0)

When it happens

Trigger: Thrown at nanobot/channels/msteams/runtime.py:487 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of HKUDS/nanobot@42f37dc4c0 (2026-08-26). Data as JSON: /api/errors/2c3901bd55b3dc00. Report an issue: GitHub.