{"record":{"id":"01a557c57161a1ae","repo":"pocketbase/pocketbase","slug":"id-token-validation-failed-w","errorCode":null,"errorMessage":"id_token validation failed: %w","messagePattern":"id_token validation failed: %w","errorType":"exception","errorClass":null,"httpStatus":400,"severity":"error","filePath":"tools/auth/apple.go","lineNumber":145,"sourceCode":"\t\tjwt.WithIssuedAt(),\n\t\tjwt.WithLeeway(idTokenLeeway),\n\t\tjwt.WithIssuer(\"https://appleid.apple.com\"),\n\t\tjwt.WithAudience(p.clientId),\n\t)\n\terr = jwtValidator.Validate(claims)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// validate id_token signature\n\t//\n\t// note: this step could be technically considered optional because we trust\n\t// the token which is a result of direct TLS communication with the provider\n\t// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)\n\t// ---\n\terr = jwk.ValidateTokenSignature(p.ctx, idToken, p.jwksURL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"id_token validation failed: %w\", err)\n\t}\n\n\treturn claims, nil\n}\n","sourceCodeStart":127,"sourceCodeEnd":150,"githubUrl":"https://github.com/pocketbase/pocketbase/blob/5d217ddb50cb144d80a5d0b0bdf11b52b2c3e457/tools/auth/apple.go#L127-L150","documentation":"Apple Sign In provider fails to validate the id_token signature. After exchanging the code with Apple, the provider parses the JWT claims and then verifies the token signature against Apple's JWKS endpoint (https://appleid.apple.com/auth/keys) using jwk.ValidateTokenSignature; any failure there is wrapped in this error.","triggerScenarios":"Apple rotating its signing keys so the cached/announced kid no longer resolves; JWKS endpoint temporarily returning an error page; a network/TLS failure fetching appleid.apple.com/auth/keys; clock skew or an actually-tampered token.","commonSituations":"Intermittent sign-in failures on Apple auth right after Apple rotates keys; corporate proxies or firewalls blocking the JWKS URL; misconfigured system time; rare regions where appleid.apple.com is throttled.","solutions":["Retry the sign-in once — transient JWKS fetch failures and post-rotation races self-heal.","Verify the server can reach https://appleid.apple.com/auth/keys (curl) and that TLS/DNS work.","Check server clock (NTP sync); large skew can break downstream JWT validation.","Inspect the wrapped error: 'missing JWK with kid' means key rotation race — retry; a network error means egress blocking."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"user, err := provider.FetchAuthUser(token)\nif err != nil {\n\tif strings.Contains(err.Error(), \"id_token validation failed\") {\n\t\t// key rotation race or transient JWKS failure: single retry\n\t\tuser, err = provider.FetchAuthUser(token)\n\t}\n\tif err != nil {\n\t\treturn redirectWithError(\"apple_signin_failed\")\n\t}\n}","preventionTips":["Monitor reachability of https://appleid.apple.com/auth/keys from your servers.","Keep server clocks NTP-synced.","Log the wrapped cause to distinguish rotation races from outages."],"tags":["oauth2","apple","jwt","jwks","network"],"backgroundTag":null,"analyzedSha":"5d217ddb50cb144d80a5d0b0bdf11b52b2c3e457","analyzedAt":"2026-08-15T10:06:33.165Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}