{"record":{"id":"7192ebad215b8b47","repo":"ory/hydra","slug":"key-not-found","errorCode":null,"errorMessage":"key not found","messagePattern":"key not found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"jwk/helper.go","lineNumber":146,"sourceCode":"\t\tr.Logger().Warnf(\"JSON Web Key Set %q does not exist yet, generating new key pair...\", set)\n\tdefault:\n\t\treturn nil, err\n\t}\n\n\treturn r.KeyManager().GenerateAndPersistKeySet(ctx, set, kid, alg, use)\n}\n\nfunc First(keys []jose.JSONWebKey) *jose.JSONWebKey {\n\tif len(keys) == 0 {\n\t\treturn nil\n\t}\n\treturn &keys[0]\n}\n\nfunc FindPublicKey(set *jose.JSONWebKeySet) (key *jose.JSONWebKey, err error) {\n\tkeys := ExcludePrivateKeys(set)\n\tif len(keys.Keys) == 0 {\n\t\treturn nil, errors.New(\"key not found\")\n\t}\n\n\treturn First(keys.Keys), nil\n}\n\nfunc FindPrivateKey(set *jose.JSONWebKeySet) (key *jose.JSONWebKey, err error) {\n\tkeys := ExcludePublicKeys(set)\n\tif len(keys.Keys) == 0 {\n\t\treturn nil, errors.New(\"key not found\")\n\t}\n\n\treturn First(keys.Keys), nil\n}\n\nfunc ExcludePublicKeys(set *jose.JSONWebKeySet) *jose.JSONWebKeySet {\n\tkeys := new(jose.JSONWebKeySet)\n\tfor _, k := range set.Keys {\n\t\tif !k.IsPublic() {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/jwk/helper.go#L128-L164","documentation":"jwk.FindPublicKey filters a JOSE key set down to its public keys via ExcludePrivateKeys and errors when nothing remains. It means the provided JSONWebKeySet contains no public key to use — typically for verifying a signature. The library throws it rather than silently returning a nil key.","triggerScenarios":"Calling FindPublicKey with a set that is empty, or that contains only private keys (which are excluded), or only keys filtered out by other means — returning `errors.New(\"key not found\")` at jwk/helper.go:146.","commonSituations":"The JWKS endpoint returned an empty `keys` array; keys were rotated and the cached set has none matching; someone published a JWKS containing only private JWKs by mistake; a test fixture loads keys from the wrong file.","solutions":["Verify the JWKS source actually returns at least one public key (`curl` the jwks_uri and inspect `keys`).","Regenerate/republish the key set including the public component of the signing key.","Check key filtering logic upstream — ensure the set passed in is not pre-stripped of public keys.","Refresh the cached key set after rotation so the new public key is present."],"exampleFix":"// before\nkey, err := jwk.FindPublicKey(&jose.JSONWebKeySet{})\n// after: ensure the set has public keys first\nset := fetchJWKS(ctx, jwksURI)\nif len(jwk.ExcludePrivateKeys(set).Keys) == 0 {\n    return fmt.Errorf(\"no public keys at %s\", jwksURI)\n}\nkey, err := jwk.FindPublicKey(set)","handlingStrategy":"type-guard","validationCode":"// check the set has public keys before calling FindPublicKey\nif len(jwk.ExcludePrivateKeys(set).Keys) == 0 {\n    return nil, fmt.Errorf(\"JWKS from %s has no public keys\", uri)\n}","typeGuard":"func hasPublicKeys(set *jose.JSONWebKeySet) bool {\n    return set != nil && len(jwk.ExcludePrivateKeys(set).Keys) > 0\n}","tryCatchPattern":"// treat as a fetch/cache problem and refresh\nkey, err := jwk.FindPublicKey(set)\nif err != nil && err.Error() == \"key not found\" {\n    set = refreshJWKS(ctx, uri)\n    key, err = jwk.FindPublicKey(set)\n}","preventionTips":["Monitor JWKS endpoints for empty key arrays","Refresh the key cache after rotations","Never publish private-only JWKs; verify the JWKS contents after key generation","Keep fixtures for signature verification updated"],"tags":["jwks","jose","oauth2","keys"],"backgroundTag":"jwks-key-not-found","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}