dgraph-io/dgraph · error

expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),

Error message

expecting either JWKUrl/JWKUrls or (VerificationKey, Algo), both were given

What it means

`validate` in Dgraph's authorization package rejects an AuthMeta that specifies both a JWK source (JWKUrl/JWKUrls) and an inline verification key pair (VerificationKey + Algo). These are mutually exclusive ways to obtain the signing key: fetch from a JWKS endpoint versus embed the key statically.

Source

Thrown at graphql/authorization/auth.go:78

	httpClient      *http.Client
	ClosedByDefault bool
}

// Validate required fields.
func (a *AuthMeta) validate() error {
	var fields string

	// If JWKUrl/JWKUrls is provided, we don't expect (VerificationKey, Algo),
	// they are needed only if JWKUrl/JWKUrls is not present there.
	if len(a.JWKUrls) != 0 || a.JWKUrl != "" {

		// User cannot provide both JWKUrl and JWKUrls.
		if len(a.JWKUrls) != 0 && a.JWKUrl != "" {
			return fmt.Errorf("expecting either JWKUrl or JWKUrls, both were given")
		}

		if a.VerificationKey != "" || a.Algo != "" {
			return fmt.Errorf("expecting either JWKUrl/JWKUrls or (VerificationKey, Algo), both were given")
		}

		// Audience should be a required field if JWKUrl is provided.
		if len(a.Audience) == 0 {
			fields = " `Audience` "
		}
	} else {
		if a.VerificationKey == "" {
			fields = " `Verification key`/`JWKUrl`/`JWKUrls`"
		}

		if a.Algo == "" {
			fields += " `Algo`"
		}
	}

	if a.Header == "" {
		fields += " `Header`"

View on GitHub (pinned to 759e242be6)

Solutions

1. Delete the `VerificationKey` and `Algo` fields and rely solely on the JWKS endpoint (JWKUrl/JWKUrls)
2. Or delete `JWKUrl`/`JWKUrls` and keep the inline VerificationKey + Algo pair
3. Ensure Algo is only present alongside VerificationKey (it's meaningless with JWKS, which publishes its own alg)

Example fix

// before
{"JWKUrl":"https://idp/.well-known/jwks.json","VerificationKey":"-----BEGIN PUBLIC KEY-----...","Algo":"RS256"}
// after
{"JWKUrl":"https://idp/.well-known/jwks.json"}

const auth = JSON.parse(process.env.DGRAPH_AUTHORIZATION);
const hasJwk = auth.JWKUrl || auth.JWKUrls?.length;
if (hasJwk && (auth.VerificationKey || auth.Algo)) {
  throw new Error('Use JWKUrl/JWKUrls OR (VerificationKey + Algo), not both');
}

const isInlineKeyConfig = (a) => !a.JWKUrl && !a.JWKUrls?.length && !!a.VerificationKey && !!a.Algo;

When it happens

Trigger: Calling Parse with a Dgraph.Authorization header where JWKUrl or JWKUrls is set AND VerificationKey or Algo is non-empty — e.g. `{"JWKUrl":"https://idp/jwks.json","VerificationKey":"...","Algo":"RS256",...}`.

Common situations: Upgrading from an old config that used an embedded key to JWKS and forgetting to delete VerificationKey/Algo; combining snippets from two tutorials; the JWKS URL not working so someone re-added an embedded key without removing the URL.

Related errors

• expecting either JWKUrl or JWKUrls, both were given
• required field missing in Dgraph.Authorization:%s
• audience value was expected but not provided
• jwt token cannot be validated because verification algorithm
• invalid jwt algorithm: found %s, but supported options are:

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/a18a698071850d81. Report an issue: GitHub.