{"record":{"id":"bc43066d0c50281e","repo":"googleapis/mcp-toolbox","slug":"failed-to-create-keyfunc-from-jwks-url-s-w","errorCode":null,"errorMessage":"failed to create keyfunc from JWKS URL %s: %w","messagePattern":"failed to create keyfunc from JWKS URL (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":94,"sourceCode":"\t\t}\n\t}\n\thttpClient := newSecureHTTPClient()\n\n\t// Discover OIDC endpoints\n\tjwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to discover OIDC config: %w\", err)\n\t}\n\n\t// Override introspection URL if configured\n\tif cfg.IntrospectionEndpoint != \"\" {\n\t\tintrospectionURL = cfg.IntrospectionEndpoint\n\t}\n\n\t// Create the keyfunc to fetch and cache the JWKS in the background\n\tkf, err := keyfunc.NewDefault([]string{jwksURL})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create keyfunc from JWKS URL %s: %w\", jwksURL, err)\n\t}\n\n\ta := &AuthService{\n\t\tConfig:           cfg,\n\t\tkf:               kf,\n\t\tclient:           httpClient,\n\t\tintrospectionURL: introspectionURL,\n\t\tissuer:           issuer,\n\t}\n\treturn a, nil\n}\n\nfunc newSecureHTTPClient() *http.Client {\n\treturn &http.Client{\n\t\tTimeout: 10 * time.Second,\n\t\tTransport: &http.Transport{\n\t\t\tForceAttemptHTTP2:     true,\n\t\t\tMaxIdleConns:          10,","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L76-L112","documentation":"This error is returned when the keyfunc library (github.com/MicahParks/keyfunc/v3) cannot initialize a JWKS-based key lookup from the discovered jwks_uri. keyfunc.NewDefault validates the JWKS URL(s) and starts background refresh; an unparseable or structurally invalid URL causes initialization to fail before the auth service is constructed.","triggerScenarios":"keyfunc.NewDefault([]string{jwksURL}) fails during Initialize() because the jwks_uri discovered from the OIDC config document is not a valid/parseable URL (e.g. relative URL, malformed scheme).","commonSituations":"A misconfigured or non-compliant authorization server advertises a jwks_uri that is not an absolute http(s) URL; or discovery returned a placeholder/invalid value.","solutions":["curl <authorizationServer>/.well-known/openid-configuration and inspect the jwks_uri value","Ensure the provider advertises an absolute https jwks_uri (e.g. https://auth.example.com/.well-known/jwks.json)","If the provider is non-compliant, fix its OIDC discovery document or switch providers","Check the wrapped keyfunc error for the exact URL validation failure"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"u, err := url.Parse(discoveredJwksURL)\nif err != nil || (u.Scheme != \"https\" && u.Scheme != \"http\") || u.Host == \"\" {\n    return fmt.Errorf(\"discovered jwks_uri %q is not a usable absolute URL\", discoveredJwksURL)\n}\nif _, err := keyfunc.NewDefault([]string{discoveredJwksURL}); err != nil {\n    return fmt.Errorf(\"keyfunc init would fail: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"kf, err := keyfunc.NewDefault([]string{jwksURL})\nif err != nil {\n    log.Printf(\"JWKS URL %q rejected by keyfunc: %v\", jwksURL, err)\n    return err\n}","preventionTips":["Verify the provider's discovery document advertises an absolute https jwks_uri","Pin/verify the auth server version if self-hosted, since discovery output changes between versions"],"tags":["go","jwks","jwt","oidc"],"backgroundTag":"jwks-url-invalid","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}