{"record":{"id":"8fccb63c0b6b3914","repo":"cloudflare/cloudflared","slug":"metadata-jwt-verification-failed-v-and-jwks-ref","errorCode":null,"errorMessage":"metadata JWT verification failed (%v) and JWKS refresh also failed: %w","messagePattern":"metadata JWT verification failed \\((.+?)\\) and JWKS refresh also failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/jwks.go","lineNumber":244,"sourceCode":"// verification retries once only when the cached keys are old enough to refresh.\nfunc verifyMetadataWithRetry(rawJWT string, authDomain url.URL) (*metadataClaims, error) {\n\tkeySet, cachedAt, err := getJWKSWithCache(authDomain)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tclaims, err := verifyMetadataJWT(rawJWT, keySet)\n\tif err == nil {\n\t\treturn claims, nil\n\t}\n\tif cachedAt.IsZero() || time.Since(cachedAt) < jwksMinRefreshInterval {\n\t\treturn nil, err\n\t}\n\n\t// Verification failed; this could be key rotation. Re-fetch JWKS and retry.\n\tkeySet, fetchErr := fetchJWKS(authDomain)\n\tif fetchErr != nil {\n\t\treturn nil, fmt.Errorf(\"metadata JWT verification failed (%v) and JWKS refresh also failed: %w\", err, fetchErr)\n\t}\n\tif err := writeJWKSCache(authDomain, keySet); err != nil {\n\t\tlog.Debug().Err(err).Msg(\"failed to write refreshed JWKS cache; continuing with fetched keys\")\n\t}\n\n\treturn verifyMetadataJWT(rawJWT, keySet)\n}\n","sourceCodeStart":226,"sourceCodeEnd":252,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/jwks.go#L226-L252","documentation":"Compound failure in verifyMetadataWithRetry: the access JWT failed verification against the cached JWKS, and the one allowed refresh path also failed because fetchJWKS returned an error (the retry exists to handle key rotation). The token cannot be verified at all, so GetAppInfo and the token flow abort.","triggerScenarios":"Thrown at token/jwks.go:244 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check network reachability of the JWKS endpoint — the underlying fetchErr says why the refresh failed.","If the JWT is expired or signed by unknown keys, obtain a new access token.","Retry after the jwksMinRefreshInterval window elapses."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}