{"record":{"id":"2bce456730da1259","repo":"windmill-labs/windmill","slug":"oidc-token-request-to-url-failed-with-status-st","errorCode":null,"errorMessage":"oidc token request to {url} failed with status {status}: {body}","messagePattern":"oidc token request to (.+?) failed with status (.+?): (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-common/src/client.rs","lineNumber":98,"sourceCode":"            .as_ref()\n            .unwrap_or(&HTTP_CLIENT)\n            .post(&url)\n            .header(\n                reqwest::header::AUTHORIZATION,\n                reqwest::header::HeaderValue::from_str(&format!(\"Bearer {}\", self.token))?,\n            )\n            .send()\n            .await\n            .map_err(|e| {\n                tracing::error!(\"Error requesting oidc token from {url}: {e:#?}\");\n                anyhow::anyhow!(\"Error requesting oidc token from {url}: {e:#?}\")\n            })?;\n\n        match response.status().as_u16() {\n            200u16 => Ok(response.text().await.context(\"reading oidc token body\")?),\n            status => {\n                let body = response.text().await.unwrap_or_default();\n                Err(anyhow::anyhow!(\n                    \"oidc token request to {url} failed with status {status}: {body}\"\n                ))\n            }\n        }\n    }\n\n    pub async fn get_resource_value<T: DeserializeOwned>(&self, path: &str) -> anyhow::Result<T> {\n        let url = format!(\n            \"{}/api/w/{}/resources/get_value/{}\",\n            self.base_internal_url, self.workspace, path\n        );\n        make_basic_get_request(self, &url, None, Some(\"decoding resource value as json\")).await\n    }\n\n    pub async fn get_variable_value(&self, path: &str) -> anyhow::Result<String> {\n        let url = format!(\n            \"{}/api/w/{}/variables/get_value/{}\",\n            self.base_internal_url, self.workspace, path","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-common/src/client.rs#L80-L116","documentation":"get_id_token received an HTTP response from the OIDC token endpoint but with a non-200 status. The error message embeds the status code and the response body, which is typically the server's JSON or text error explaining why the token could not be issued (auth failure, unknown audience, disabled token endpoint).","triggerScenarios":"POST /api/w/{ws}/oidc/token/{audience} returns 401/403 (the Bearer token is invalid, expired, or lacks permission), 404 (audience/token-issuer not configured for the workspace or wrong workspace id), 400 (invalid audience format), or 5xx from the upstream OIDC identity provider.","commonSituations":"Using a stale/revoked worker token, typo in the audience parameter, OIDC not configured in instance settings, hitting the wrong workspace in multi-workspace setups, upstream IdP (Keycloak/Auth0) outage returning 502/503.","solutions":["Read the body in the error message — it names the server-side reason (invalid token, unknown audience, etc.)","Refresh the token used by the AuthedClient; re-authenticate the worker/agent","Confirm the audience exists: check instance OIDC settings and that the audience was registered for this workspace","Verify the workspace id in base URL matches an existing workspace","If 5xx, check the upstream identity provider health and backend logs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Confirm audience is configured before requesting (the route is POST-only; check\n// instance OIDC settings), and reject obviously malformed audiences:\nif audience.trim().is_empty() || audience.contains(' ') { anyhow::bail!(\"invalid oidc audience: {audience:?}\"); }","typeGuard":null,"tryCatchPattern":"match client.get_id_token(aud).await {\n    Err(e) if e.to_string().contains(\"failed with status\") => {\n        let msg = e.to_string();\n        if msg.contains(\"401\") || msg.contains(\"403\") { /* rotate token and retry once */ }\n        else if msg.contains(\"404\") { /* audience/workspace not configured: fix config, don't retry */ }\n        else if msg.contains(\"status 5\") { /* upstream IdP issue: retry with backoff */ }\n        Err(e)\n    }\n    other => other,\n}","preventionTips":["Rotate worker/agent tokens before expiry and reload them on 401","Register every audience you request in instance OIDC settings","Verify workspace id in the client matches the audience's workspace","Alert on 5xx statuses from this endpoint as upstream-IdP incidents"],"tags":["http","oidc","auth","status-code"],"backgroundTag":"http-4xx-auth-rejected","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}