{"record":{"id":"2870d2913d0bd38f","repo":"cloudflare/cloudflared","slug":"failed-to-retrieve-jwt-claims","errorCode":null,"errorMessage":"failed to retrieve JWT claims","messagePattern":"failed to retrieve JWT claims","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sshgen/sshgen.go","lineNumber":101,"sourceCode":"\t}\n\n\treturn SignCert(token, string(pub))\n}\n\nfunc SignCert(token, pubKey string) (string, error) {\n\tif token == \"\" {\n\t\treturn \"\", errors.New(\"invalid token\")\n\t}\n\n\tparsedToken, err := jwt.ParseSigned(token, signatureAlgs)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to parse JWT\")\n\t}\n\n\tclaims := jwt.Claims{}\n\terr = parsedToken.UnsafeClaimsWithoutVerification(&claims)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to retrieve JWT claims\")\n\t}\n\n\tbuf, err := json.Marshal(&signPayload{\n\t\tPublicKey: pubKey,\n\t\tJWT:       token,\n\t\tIssuer:    claims.Issuer,\n\t})\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to marshal signPayload\")\n\t}\n\tvar res *http.Response\n\tif mockRequest != nil {\n\t\tres, err = mockRequest(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))\n\t} else {\n\t\tclient := http.Client{\n\t\t\tTimeout: 10 * time.Second,\n\t\t}\n\t\tres, err = client.Post(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/sshgen/sshgen.go#L83-L119","documentation":"SignCert parses a JWT token and extracts its claims to build a certificate signing request. This error means the token itself parsed, but the claim payload inside could not be decoded into jwt.Claims via UnsafeClaimsWithoutVerification. The library wraps the underlying decode failure so the caller knows which phase of token processing failed.","triggerScenarios":"SignCert is called with a JWT whose decoded payload is not valid JSON or does not map to the expected claim fields (e.g. issuer not a string).","commonSituations":"Passing a corrupted or hand-edited token from cloudflared's config; passing a non-JWT opaque token; using a token whose claims contain unexpected types after an upstream format change.","solutions":["Verify the token is a real JWT with three dot-separated base64 segments and a JSON payload","Decode the payload (e.g. base64 -d on the middle segment) and confirm the claims parse as JSON with the expected fields","Re-run `cloudflared login` to obtain a fresh, well-formed token from Cloudflare","Check for accidental whitespace/newlines or truncation when the token was copied into configuration"],"exampleFix":"// before\nerr = parsedToken.UnsafeClaimsWithoutVerification(&claims)\n// after\nif parsedToken == nil {\n    return \"\", errors.New(\"nil token\")\n}\nif err = parsedToken.UnsafeClaimsWithoutVerification(&claims); err != nil {\n    return \"\", errors.Wrap(err, \"failed to retrieve JWT claims\")\n}","handlingStrategy":"validation","validationCode":"// validate token shape before calling SignCert\nparts := strings.Split(token, \".\")\nif len(parts) != 3 {\n    return errors.New(\"token is not a JWT (expected 3 segments)\")\n}\npayload, err := base64.RawURLEncoding.DecodeString(parts[1])\nif err != nil {\n    return fmt.Errorf(\"JWT payload not base64url: %w\", err)\n}\nvar probe map[string]json.RawMessage\nif err := json.Unmarshal(payload, &probe); err != nil {\n    return fmt.Errorf(\"JWT payload not valid JSON: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := SignCert(token, pubKey); err != nil {\n    if strings.Contains(err.Error(), \"failed to retrieve JWT claims\") {\n        // regenerate token via `cloudflared access login` and retry once\n    }\n}","preventionTips":["Always obtain tokens via `cloudflared access login`/tokens API, never hand-edit them","Validate the JWT shape (3 segments, JSON payload) before passing it in","Avoid copying tokens through editors that may truncate or wrap lines"],"tags":["jwt","ssh","certificates"],"backgroundTag":"jwt-token-expired","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}