{"record":{"id":"a9d3c315494f9364","repo":"invoke-ai/InvokeAI","slug":"jwt-secret-has-not-been-initialized-call-set-jwt","errorCode":null,"errorMessage":"JWT secret has not been initialized. Call set_jwt_secret() during application startup.","messagePattern":"JWT secret has not been initialized\\. Call set_jwt_secret\\(\\) during application startup\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"invokeai/app/services/auth/token_service.py","lineNumber":56,"sourceCode":"\n    Args:\n        secret: The JWT secret key\n    \"\"\"\n    global _jwt_secret\n    _jwt_secret = secret\n\n\ndef get_jwt_secret() -> str:\n    \"\"\"Get the JWT secret key.\n\n    Returns:\n        The JWT secret key\n\n    Raises:\n        RuntimeError: If the secret has not been initialized\n    \"\"\"\n    if _jwt_secret is None:\n        raise RuntimeError(\"JWT secret has not been initialized. Call set_jwt_secret() during application startup.\")\n    return _jwt_secret\n\n\ndef create_access_token(data: TokenData, expires_delta: timedelta | None = None) -> str:\n    \"\"\"Create a JWT access token.\n\n    Args:\n        data: The token data to encode\n        expires_delta: Optional expiration time delta. Defaults to 24 hours.\n\n    Returns:\n        The encoded JWT token\n    \"\"\"\n    to_encode = data.model_dump()\n    expire = datetime.now(timezone.utc) + (expires_delta or timedelta(hours=DEFAULT_EXPIRATION_HOURS))\n    to_encode.update({\"exp\": expire})\n    return cast(str, jwt.encode(to_encode, get_jwt_secret(), algorithm=ALGORITHM))\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/services/auth/token_service.py#L38-L74","documentation":"The token_service module keeps a module-level _jwt_secret that must be populated via set_jwt_secret() at application startup. get_jwt_secret() raises this RuntimeError whenever token creation or verification is attempted before that initialization, since signing/verifying with a None secret is impossible.","triggerScenarios":"Calling create_access_token() or verify_token() before the app startup hook invoked set_jwt_secret(); running auth code in tests or scripts that bypass application startup; an exception during startup that skipped secret initialization.","commonSituations":"Unit-testing token endpoints without the startup fixture; calling auth utilities from a background worker or CLI that never runs app startup; startup ordering bug where auth routes initialize before the secret is set.","solutions":["Ensure set_jwt_secret() (with the secret from app_settings.get_jwt_secret()) is called during application startup before any auth call","In tests/scripts, call set_jwt_secret() in fixtures/setup before using create_access_token or verify_token","Check startup logs for a failure that prevented initialization; fix the earlier exception so the secret gets set"],"exampleFix":"// before\ntoken = create_access_token(data)  # RuntimeError: secret not initialized\n// after\nset_jwt_secret(app_settings.get_jwt_secret())\ntoken = create_access_token(data)","handlingStrategy":"validation","validationCode":"import invokeai.app.services.auth.token_service as ts\nassert ts._jwt_secret is not None, \"call set_jwt_secret() before using token_service\"","typeGuard":null,"tryCatchPattern":"try:\n    token = create_access_token(data)\nexcept RuntimeError as e:\n    if 'set_jwt_secret' in str(e):\n        set_jwt_secret(app_settings.get_jwt_secret())\n        token = create_access_token(data)\n    else:\n        raise","preventionTips":["Always initialize token_service in the app startup hook before mounting auth routes","In tests, set the secret in a fixture (e.g. autouse setup) ","Fix any earlier startup exceptions that abort initialization"],"tags":["runtime-error","jwt","initialization","auth"],"backgroundTag":"missing-jwt-secret","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}