crowdsecurity/crowdsec · error

could not get jwt token: %w

Error message

could not get jwt token: %w

What it means

Returned by refreshJwtToken when the HTTP POST to the /watchers/login endpoint fails at the transport level (connection refused, timeout, DNS failure) while fetching a new JWT. Wraps the client.Do error; the server was never successfully reached.

Source

Thrown at pkg/apiclient/auth_jwt.go:107

			withBackOff:      true,
			retryStatusCodes: []int{http.StatusTooManyRequests, http.StatusServiceUnavailable, http.StatusGatewayTimeout, http.StatusInternalServerError},
		},
	}

	if t.UserAgent != "" {
		req.Header.Add("User-Agent", t.UserAgent)
	}

	if log.IsLevelEnabled(log.TraceLevel) {
		dump, _ := httputil.DumpRequest(req, true)
		log.Tracef("auth-jwt request: %s", string(dump))
	}

	log.Debugf("auth-jwt(auth): %s %s", req.Method, req.URL.String())

	resp, err := client.Do(req)
	if err != nil {
		return fmt.Errorf("could not get jwt token: %w", err)
	}

	log.Debugf("auth-jwt : http %d", resp.StatusCode)

	if log.IsLevelEnabled(log.TraceLevel) {
		dump, _ := httputil.DumpResponse(resp, true)
		log.Tracef("auth-jwt response: %s", string(dump))
	}

	defer resp.Body.Close()

	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		log.Debugf("received response status %q when fetching %v", resp.Status, req.URL)

		err = CheckResponse(resp)
		if err != nil {
			return err
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the LAPI URL and that lapi is listening
2. Check network connectivity, proxy and TLS certificates
3. Retry with backoff; the transport retries on transient errors already

When it happens

Trigger: Thrown at pkg/apiclient/auth_jwt.go:107 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/88b31356895c59b1. Report an issue: GitHub.