dgraph-io/dgraph · error

claims in jwt token is not map claims

Error message

claims in jwt token is not map claims

What it means

After a successful jwt.Parse, ParseJWT asserts the parsed Claims to jwt.MapClaims and checks token.Valid. If the assertion fails or the token is otherwise invalid, this error is returned. In practice this happens when the token's claims type is unexpected (not a map of string->interface{}, e.g. a registered claims struct was encoded) or the parser reports the token invalid despite no error.

Source

Thrown at x/jwt_helper.go:50

		if WorkerConfig.AclJwtAlg == nil {
			return nil, errors.Errorf("ACL is disabled")
		}
		if token.Method.Alg() != WorkerConfig.AclJwtAlg.Alg() {
			return nil, errors.Errorf("unexpected signing method in token: %v", token.Header["alg"])
		}
		return MaybeKeyToBytes(WorkerConfig.AclPublicKey), nil
	})
	if err != nil {
		// This is for backward compatibility in clients
		if errors.Is(err, jwt.ErrTokenExpired) {
			err = errors.Wrap(errTokenExpired, jwt.ErrTokenInvalidClaims.Error())
		}
		return nil, errors.Wrapf(err, "unable to parse jwt token")
	}

	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok || !token.Valid {
		return nil, errors.Errorf("claims in jwt token is not map claims")
	}
	return claims, nil
}

func ExtractUserName(jwtToken string) (string, error) {
	claims, err := ParseJWT(jwtToken)
	if err != nil {
		return "", err
	}
	userId, ok := claims["userid"].(string)
	if !ok {
		return "", errors.Errorf("userid in claims is not a string:%v", userId)
	}

	return userId, nil
}

func ExtractNamespaceFromJwt(jwtToken string) (uint64, error) {

View on GitHub (pinned to 759e242be6)

Solutions

1. Re-issue the token with map-style claims (jwt.MapClaims / standard registered claims as a JSON object).
2. Verify which condition failed: decode the token payload and confirm claims is a JSON object, not an array or scalar.
3. Check the minting library/code path for a custom Claims struct; switch it to jwt.MapClaims.
4. If token.Valid is false with nil error, update/verify the golang-jwt/jwt v5 usage and validation options.

Example fix

// before: mint with struct claims
tok := jwt.NewWithClaims(alg, myCustomClaims{...})
// after: mint with map claims
tok := jwt.NewWithClaims(alg, jwt.MapClaims{"userid": "u1", "namespace": 0, "exp": time.Now().Add(time.Hour).Unix()})

// peek at payload before sending
parts := strings.Split(token, ".")
payload, _ := base64.RawURLEncoding.DecodeString(parts[1])
if !json.Valid(payload) || payload[0] != '{' {
    return errors.New("jwt payload is not a JSON object of claims")
}

func validMapClaims(token *jwt.Token) (jwt.MapClaims, bool) {
    claims, ok := token.Claims.(jwt.MapClaims)
    return claims, ok && token.Valid
}

claims, err := x.ParseJWT(token)
if err != nil {
    if strings.Contains(err.Error(), "claims in jwt token is not map claims") {
        // token was minted with non-map claims: re-issue with jwt.MapClaims
    }
    return err
}

When it happens

Trigger: token.Claims does not type-assert to jwt.MapClaims (token was created with a concrete claims struct like jwt.RegisteredClaims) or token.Valid is false after Parse returned no error.

Common situations: Tokens minted by another service using a custom Claims type rather than map claims; hand-edited tokens; a JWT library version mismatch changing claims decoding behavior; tampered tokens that fail validity checks.

Related errors

• claims in jwt token is not map claims
• required field missing in Dgraph.Authorization:%s
• expecting either JWKUrl or JWKUrls, both were given
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),
• invalid Bearer-formatted header value for JWT (%s)

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/70278d0ea1cf7279. Report an issue: GitHub.