crowdsecurity/crowdsec · error

unable to parse jwt expiration: %w

Error message

unable to parse jwt expiration: %w

What it means

refreshJwtToken parses the 'expire' field of the auth response into the token expiration; the timestamp string from the API could not be parsed, so token validity tracking fails and the refresh is aborted.

Source

Thrown at pkg/apiclient/auth_jwt.go:135

	defer resp.Body.Close()

	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		log.Debugf("received response status %q when fetching %v", resp.Status, req.URL)

		err = CheckResponse(resp)
		if err != nil {
			return err
		}
	}

	var response models.WatcherAuthResponse

	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
		return fmt.Errorf("unable to decode response: %w", err)
	}

	if err := t.Expiration.UnmarshalText([]byte(response.Expire)); err != nil {
		return fmt.Errorf("unable to parse jwt expiration: %w", err)
	}

	t.Token = response.Token

	if t.TokenSave != nil {
		err = t.TokenSave(ctx, t.Token)
		if err != nil {
			log.Errorf("unable to save token: %s", err)
		}
	}

	log.Debugf("token %s will expire on %s", t.Token, t.Expiration.String())

	select {
	case t.TokenRefreshChan <- struct{}{}:
	default:
		// Do not block if no one is waiting for the token refresh (ie, PAPI fully disabled)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Check LAPI version compatibility with the client
2. Inspect the raw auth-jwt response in trace logs
3. Report a bug if LAPI is stock and up to date

When it happens

Trigger: Thrown at pkg/apiclient/auth_jwt.go:135 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/83fe132eb9ec226d. Report an issue: GitHub.