argoproj/argo-workflows · error

failed to unmarshal bearer token's JWT payload: %w

Error message

failed to unmarshal bearer token's JWT payload: %w

What it means

The JWT payload decoded to bytes but json.Unmarshal into types.Claims failed — the payload is valid base64 but not the expected claims JSON object. This blocks extracting the service-account identity in server auth mode.

Source

Thrown at server/auth/serviceaccount/claims.go:58

			return nil, fmt.Errorf("failed to read bearer token file: %w", err)
		}
		bearerToken = string(data)
	}

	parts := strings.SplitN(bearerToken, ".", 3)
	if len(parts) != 3 {
		return nil, fmt.Errorf("expected bearer token to be a JWT and therefore have 3 dot-delimited parts")
	}
	payload := parts[1]
	data, err := base64.RawStdEncoding.DecodeString(payload)
	if err != nil {
		return nil, fmt.Errorf("failed to decode bearer token's JWT payload: %w", err)
	}

	claims := &types.Claims{}
	err = json.Unmarshal(data, &claims)
	if err != nil {
		return nil, fmt.Errorf("failed to unmarshal bearer token's JWT payload: %w", err)
	}

	// attempt to derive SA name and namespace from Subject
	// "system:serviceaccount:argo:jenkins" -> "argo", "jenkins"
	// note that the SA name can have a colon in it, although the rest cannot
	parts = strings.SplitN(claims.Subject, ":", 4)
	if len(parts) < 4 {
		return claims, nil
	}
	claims.ServiceAccountNamespace = parts[2]
	claims.ServiceAccountName = parts[3]

	return claims, nil
}

func ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {
	var cert *x509.Certificate
	var err error

View on GitHub (pinned to 35bff19146)

Solutions

1. Verify the token payload is a standard Kubernetes SA claims JSON
2. Regenerate the token from a real service account

When it happens

Trigger: Thrown at server/auth/serviceaccount/claims.go:58 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/6a5f51056083f2a2. Report an issue: GitHub.