{"record":{"id":"067263f09e304b17","repo":"dgraph-io/dgraph","slug":"while-getting-jwt-auth-token","errorCode":null,"errorMessage":"while getting jwt auth token","messagePattern":"while getting jwt auth token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upgrade/change_v21.03.0.go","lineNumber":151,"sourceCode":"\t\top := &api.Operation{\n\t\t\tDropOp:    api.Operation_TYPE,\n\t\t\tDropValue: typ,\n\t\t}\n\t\tif err := alterWithClient(dg, op); err != nil {\n\t\t\treturn errors.Wrapf(err, \"error deleting old type %s\", typ)\n\t\t}\n\t}\n\tfmt.Println(\"Successfully dropped the deprecated predicates\")\n\treturn nil\n}\n\nfunc upgradePersitentQuery() error {\n\tdg, cb := x.GetDgraphClient(Upgrade.Conf, hasAclCreds())\n\tdefer cb()\n\n\tjwt, err := getAccessJwt()\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"while getting jwt auth token\")\n\t}\n\n\t// Get persisted queries.\n\tqueryData := make(map[string][]pquery)\n\tif err := getQueryResult(dg, queryPersistedQuery_v21_03_0, &queryData); err != nil {\n\t\treturn errors.Wrap(err, \"error querying persisted queries\")\n\t}\n\n\t// Update the schema with new indexer for persisted query.\n\tupdatedSchema := `\n\t\t<dgraph.graphql.p_query>: string @index(sha256) .\n\t\ttype <dgraph.graphql.persisted_query> {\n\t\t\t<dgraph.graphql.p_query>\n\t\t}\n\t\t\t`\n\tif err := alterWithClient(dg, &api.Operation{Schema: updatedSchema}); err != nil {\n\t\treturn fmt.Errorf(\"error updating the schema for persistent query, %w\", err)\n\t}","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/upgrade/change_v21.03.0.go#L133-L169","documentation":"upgradePersitentQuery calls getAccessJwt to obtain a JWT before touching persisted queries. If that fails, the error is wrapped as 'while getting jwt auth token'. The upgrade tool could not authenticate against the /graphql or /health endpoint to get an access token.","triggerScenarios":"getAccessJwt returns an error — wrong username/password for ACL, ACL not enabled but creds supplied (or vice versa), or the login endpoint is unreachable.","commonSituations":"ACL credentials not passed or mistyped on the upgrade command line; cluster reachable but authentication endpoint misconfigured; TLS/certificate mismatch preventing login.","solutions":["Pass correct ACL credentials (or omit hasAclCreds if ACL is disabled) to the upgrade command.","Verify the Dgraph Zero/Alpha endpoints are reachable with curl before running the upgrade.","Check for TLS config mismatch and supply the right CA/certs.","Confirm the ACL user has the admin group permission."],"exampleFix":"// before\nUpgrade.Upgrade \"--acls\" missing creds\n// after\ndgraph upgrade --acls \"user:password\" ... (correct admin ACL creds)","handlingStrategy":"validation","validationCode":"curl -s -XPOST http://localhost:8080/graphql -d '{\"query\":\"mutation { login(userId:\\\"groot\\\", password:\\\"password\\\"){ accessJWT }}\"}'  # confirm creds work before upgrade","typeGuard":null,"tryCatchPattern":"jwt, err := getAccessJwt()\nif err != nil {\n\treturn errors.Wrap(err, \"while getting jwt auth token\")\n}","preventionTips":["Pass correct --acls admin credentials to the upgrade command","Validate credentials against /graphql login before running migrations","Check TLS/CA configuration matches the cluster"],"tags":["dgraph","upgrade","jwt","auth","acl"],"backgroundTag":"jwt-token-acquisition-failed","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}