{"record":{"id":"1a9a0e68d07dc920","repo":"googleapis/mcp-toolbox","slug":"no-access-jwt-found-in-the-response","errorCode":null,"errorMessage":"no access JWT found in the response","messagePattern":"no access JWT found in the response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/sources/dgraph/dgraph.go","lineNumber":331,"sourceCode":"\t}\n\n\tif err := checkError(resp); err != nil {\n\t\treturn err\n\t}\n\n\tvar r struct {\n\t\tData struct {\n\t\t\tAccessJWT  string `json:\"accessJWT\"`\n\t\t\tRefreshJWT string `json:\"refreshJWT\"`\n\t\t} `json:\"data\"`\n\t}\n\n\tif err := json.Unmarshal(resp, &r); err != nil {\n\t\treturn fmt.Errorf(\"failed to unmarshal response: %v\", err)\n\t}\n\n\tif r.Data.AccessJWT == \"\" {\n\t\treturn fmt.Errorf(\"no access JWT found in the response\")\n\t}\n\tif r.Data.RefreshJWT == \"\" {\n\t\treturn fmt.Errorf(\"no refresh JWT found in the response\")\n\t}\n\n\thc.AccessJwt = r.Data.AccessJWT\n\thc.RefreshToken = r.Data.RefreshJWT\n\treturn nil\n}\n\nfunc (hc *DgraphClient) healthCheck() error {\n\turl, err := getUrl(hc.baseUrl, \"/health\", nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\treq, err := http.NewRequest(http.MethodGet, url, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error creating request: %w\", err)","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/dgraph/dgraph.go#L313-L349","documentation":"The login response parsed successfully as JSON, but the data.accessJWT field is empty, so doLogin refuses to store a blank token. Dgraph omits accessJWT when authentication failed or the response is a valid-JSON error body. This converts a silently-empty credential into an explicit login failure.","triggerScenarios":"Dgraph /login returns JSON without an accessJWT field — typically wrong user/password/reset_password credentials, an ACL-enabled cluster where the user does not exist, or hitting an endpoint that does not perform ACL login (e.g. enterprise ACL features disabled).","commonSituations":"ACL credentials not configured or wrong in the source config; connecting to an Open Source Dgraph without ACL enabled (login is a no-op returning no tokens); typos in the username or password; user namespace mismatch (e.g. missing guardian user).","solutions":["Verify the username and password (and reset_password/refresh token, if used) in the dgraph source config are correct for the ACL-enabled cluster.","Confirm ACL is actually enabled on the Dgraph cluster; on clusters without ACL, /login returns no JWTs.","Check the user exists and has appropriate permissions (e.g. is a guardian) via Dgraph's ACL user management.","Inspect the full login response body for an accompanying error message field explaining why no token was issued.","If using a refresh token flow, ensure the refresh token is valid and not expired."],"exampleFix":"// before (config)\ndgraph:\n  baseURL: http://localhost:8080\n  user: admin\n  password: \"\"\n// after\ndgraph:\n  baseURL: http://localhost:8080\n  user: groot\n  password: \"<correct-acl-password>\"","handlingStrategy":"validation","validationCode":"if user == \"\" || password == \"\" {\n  return errors.New(\"dgraph ACL credentials (user/password) must be set before login\")\n}\n// preflight ACL check\nresp, _ := http.Get(baseURL + \"/admin\")\n_ = resp // cluster must have ACL enabled for /login to return JWTs","typeGuard":"func hasAccessToken(r loginResponse) bool { return r.Data.AccessJWT != \"\" }","tryCatchPattern":"if err := loginWithCredentials(ctx, user, pass); err != nil {\n  if strings.Contains(err.Error(), \"no access JWT\") {\n    // check credentials and that ACL is enabled on the cluster\n    log.Printf(\"dgraph login rejected: verify ACL user/password: %v\", err)\n    return\n  }\n}","preventionTips":["Store ACL user/password in env vars or secrets, never hardcoded or left empty.","Confirm ACL is enabled on the Dgraph cluster before configuring login-based auth.","Verify the user exists and has guardian/appropriate permissions.","Test credentials with a direct curl POST to /login before wiring them into the toolbox.","Rotate refresh tokens and passwords before expiry to avoid silent auth refusals."],"tags":["authentication","jwt","dgraph","acl","login"],"backgroundTag":"missing-access-token","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}