{"record":{"id":"a51d545c70225726","repo":"wavetermdev/waveterm","slug":"error-getting-jwt-public-key-v","errorCode":null,"errorMessage":"error getting jwt public key: %v","messagePattern":"error getting jwt public key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/wsh/cmd/wshcmd-connserver.go","lineNumber":251,"sourceCode":"\t}()\n\trouter.RegisterUpstream(termProxy)\n\n\tsockName := getRemoteDomainSocketName()\n\n\t// setup the connserver rpc client first\n\tclient, bareRouteId, err := setupConnServerRpcClientWithRouter(router, sockName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error setting up connserver rpc client: %v\", err)\n\t}\n\twshfs.RpcClient = client\n\twshfs.RpcClientRouteId = bareRouteId\n\n\tlog.Printf(\"trying to get JWT public key\")\n\n\t// fetch and set JWT public key\n\tjwtPublicKeyB64, err := wshclient.GetJwtPublicKeyCommand(client, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error getting jwt public key: %v\", err)\n\t}\n\tjwtPublicKeyBytes, err := base64.StdEncoding.DecodeString(jwtPublicKeyB64)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error decoding jwt public key: %v\", err)\n\t}\n\terr = wavejwt.SetPublicKey(jwtPublicKeyBytes)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error setting jwt public key: %v\", err)\n\t}\n\n\tlog.Printf(\"got JWT public key\")\n\n\t// now set up the domain socket\n\tunixListener, err := MakeRemoteUnixListener()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot create unix listener: %v\", err)\n\t}\n\tlog.Printf(\"unix listener started\")","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/cmd/wsh/cmd/wshcmd-connserver.go#L233-L269","documentation":"Returned by serverRunRouter when the GetJwtPublicKeyCommand RPC fails after the RPC client is set up. The server needs the JWT public key to validate tokens; failing to fetch it aborts startup. The wrapped error carries the RPC-level cause.","triggerScenarios":"The GetJwtPublicKeyCommand call errors: the connserver dropped the route right after connect, the RPC times out, or the server refuses to serve the key (auth/version mismatch).","commonSituations":"Connserver restarting concurrently with router startup, network/socket disruption mid-handshake, client-server version mismatch removing or renaming the RPC method, permission denial on the server side.","solutions":["Retry the server startup — a concurrent connserver restart often causes transient failures","Check the connserver logs to see why it refused or failed to serve the JWT public key","Verify client and server wsh versions match so the GetJwtPublicKey RPC exists on both","Confirm the RPC connection is still alive before the call (the client was just set up — a quick drop points at the connserver)"],"exampleFix":"// before\njwtPublicKeyB64, err := wshclient.GetJwtPublicKeyCommand(client, nil)\nif err != nil {\n    return fmt.Errorf(\"error getting jwt public key: %v\", err)\n}\n// after\nvar jwtPublicKeyB64 string\nvar err error\nfor i := 0; i < 3; i++ {\n    jwtPublicKeyB64, err = wshclient.GetJwtPublicKeyCommand(client, &wshrpc.RpcOpts{Timeout: 10000})\n    if err == nil {\n        break\n    }\n    time.Sleep(500 * time.Millisecond)\n}\nif err != nil {\n    return fmt.Errorf(\"error getting jwt public key: %v\", err)\n}","handlingStrategy":"retry","validationCode":"if client == nil || bareRouteId == \"\" {\n    return fmt.Errorf(\"rpc client not ready; cannot fetch jwt public key\")\n}","typeGuard":null,"tryCatchPattern":"var jwtPublicKeyB64 string\nvar err error\nfor i := 0; i < 3; i++ {\n    if jwtPublicKeyB64, err = wshclient.GetJwtPublicKeyCommand(client, &wshrpc.RpcOpts{Timeout: 10000}); err == nil {\n        break\n    }\n    time.Sleep(500 * time.Millisecond)\n}\nif err != nil {\n    return fmt.Errorf(\"error getting jwt public key: %v\", err)\n}","preventionTips":["Retry key fetch with backoff — connserver restarts are transient","Check connserver logs when the key RPC fails repeatedly","Keep client/server versions aligned so the RPC method exists","Ensure auth on the connserver permits serving the key to this client"],"tags":["rpc","jwt","startup","authentication"],"backgroundTag":"jwt-key-fetch-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}