dgraph-io/dgraph · error

No JWKUrl supplied

Error message

No JWKUrl supplied

What it means

FetchJWKs fetches a JWK set for every configured JWKUrl, and refuses to run when the JWKUrls slice is empty — there is nothing to fetch. It signals that AuthMeta was created without any JWK URL even though JWK-based authentication is being attempted.

Source

Thrown at graphql/authorization/auth.go:430

		return nil, errors.Errorf("unable to parse jwt token:%v", err)
	}

	claims, ok := token.Claims.(*CustomClaims)
	if !ok || !token.Valid {
		return nil, errors.Errorf("claims in jwt token is not map claims")
	}

	if err := claims.validateAudience(); err != nil {
		return nil, err
	}
	return claims, nil
}

// FetchJWKs fetches the JSON Web Key sets for the JWKUrls. It returns an error if
// the fetching of key is failed even for one of the JWKUrl.
func (a *AuthMeta) FetchJWKs() error {
	if len(a.JWKUrls) == 0 {
		return errors.Errorf("No JWKUrl supplied")
	}

	for i := range a.JWKUrls {
		err := a.FetchJWK(i)
		if err != nil {
			return err
		}
	}
	return nil
}

// FetchJWK fetches the JSON web Key set for the JWKUrl at a given index.
func (a *AuthMeta) FetchJWK(i int) error {
	if len(a.JWKUrls) <= i {
		return errors.Errorf("not enough JWKUrls")
	}

	req, err := http.NewRequest("GET", a.JWKUrls[i], nil)

View on GitHub (pinned to 759e242be6)

Solutions

1. Populate JWKUrls with your identity provider's JWKS endpoint(s), e.g. https://<issuer>/.well-known/jwks.json.
2. Check the config/env plumbing so the JWK URLs actually reach AuthMeta at startup.
3. Fail fast at boot: treat empty JWKUrls as fatal config if JWKS auth is expected.
4. If you intend static-key auth instead, skip FetchJWKs and set Algo/VerificationKey.
5. Add a startup config dump (redacting secrets) to catch empty lists.

Example fix

// before
auth := &authorization.AuthOptions{ Algo: "RS256" }
err := auth.FetchJWKs() // "No JWKUrl supplied"
// after
auth := &authorization.AuthOptions{
    Algo: "RS256",
    JWKUrls: []string{"https://idp.example.com/.well-known/jwks.json"},
}
if err := auth.FetchJWKs(); err != nil {
    log.Fatalf("failed to fetch JWKs: %v", err)
}

if len(cfg.JWKUrls) == 0 {
    return errors.New("startup aborted: auth.jwk_urls must contain at least one JWKS endpoint")
}
if err := auth.FetchJWKs(); err != nil {
    return fmt.Errorf("startup aborted: %w", err)
}

if err := auth.FetchJWKs(); err != nil {
    if strings.Contains(err.Error(), "No JWKUrl supplied") {
        log.Fatal("config error: no JWK URLs configured for JWKS authentication")
    }
    return err
}

When it happens

Trigger: Calling AuthMeta.FetchJWKs() (typically at service startup before serving requests) while a.JWKUrls has length 0.

Common situations: Config file missing the jwk_urls key or parsed as empty list; env var for JWKS URL unset; constructing AuthOptions in code and forgetting JWKUrls; YAML/JSON structure mismatch so the field binds elsewhere.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• jwt token cannot be validated because verification algorithm
• couldn't parse signing method from token header: %s
• not enough JWKUrls
• connection string cannot be empty
• bulk output directory cannot be empty

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/7d574a83225923cf. Report an issue: GitHub.