{"record":{"id":"fab63b81c5f3be4f","repo":"ory/hydra","slug":"unable-to-find-json-web-key-with-id-s","errorCode":null,"errorMessage":"unable to find JSON Web Key with ID: %s","messagePattern":"unable to find JSON Web Key with ID: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jwksx/fetcher.go","lineNumber":73,"sourceCode":"\n\tvar set jose.JSONWebKeySet\n\tif err := json.NewDecoder(res.Body).Decode(&set); err != nil {\n\t\treturn nil, errors.WithStack(err)\n\t}\n\n\tfor _, k := range set.Keys {\n\t\tf.Lock()\n\t\tf.keys[k.KeyID] = k\n\t\tf.Unlock()\n\t}\n\n\tf.RLock()\n\tdefer f.RUnlock()\n\tif k, ok := f.keys[kid]; ok {\n\t\treturn &k, nil\n\t}\n\n\treturn nil, errors.Errorf(\"unable to find JSON Web Key with ID: %s\", kid)\n}\n","sourceCodeStart":55,"sourceCodeEnd":75,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jwksx/fetcher.go#L55-L75","documentation":"Fetcher.GetKey looks up the requested key ID (kid) in the cache after (possibly) fetching the remote JWKS. If the fetched key set contains no key whose KeyID equals kid, it errors with this message. The set was fetched fine; the specific kid simply is not published there.","triggerScenarios":"Calling Fetcher.GetKey(kid) (oryx/jwksx/fetcher.go:73) with a kid that does not exist in the remote JWKS — typically a kid taken from a token's JWT header that the fetched key set never contained.","commonSituations":"Verifying tokens signed with a rotated-out key after the JWKS was refreshed; using the wrong issuer's JWKS URL; stale local cache that was populated before rotation; tokens minted by a different environment (staging token verified against prod keys).","solutions":["Refresh the key set (create a new Fetcher or clear the cache) in case it is stale relative to the signing key rotation.","Verify the JWKS URL matches the issuer that actually signed the token (check token 'iss' and discovery 'jwks_uri').","Compare the token header 'kid' against the kids in the fetched JWKS (jose.JSONWebKeySet) to confirm the mismatch.","Ensure you are verifying a token from the right environment/tenant; cross-environment tokens will never match."],"exampleFix":"// before\nkey, err := fetcher.GetKey(tokenKid) // stale cache\n// after\nfetcher = jwksx.NewFetcher(remoteJWKSURL) // re-fetch fresh keys\nkey, err := fetcher.GetKey(tokenKid)","handlingStrategy":"fallback","validationCode":"set, _ := fetchRemoteJWKS(jwksURL)\nif !containsKid(set.Keys, tokenHeader.Kid) {\n    return fmt.Errorf(\"kid %s not present at %s; check issuer/rotation\", tokenHeader.Kid, jwksURL)\n}","typeGuard":null,"tryCatchPattern":"key, err := fetcher.GetKey(kid)\nif err != nil {\n    fetcher = jwksx.NewFetcher(remoteURL) // refresh cache once\n    key, err = fetcher.GetKey(kid)\n    if err != nil { return fmt.Errorf(\"unknown kid %q for issuer\", kid) }\n}","preventionTips":["Refresh the JWKS on unknown kid instead of failing permanently.","Verify the token issuer matches the JWKS source.","Keep a fallback of previously rotated public keys."],"tags":["jwks","jwt","key-rotation"],"backgroundTag":"jwk-kid-not-found","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}