dgraph-io/dgraph · error

required field missing in Dgraph.Authorization:%s

Error message

required field missing in Dgraph.Authorization:%s

What it means

Dgraph's `validate` checks that the mandatory AuthMeta fields are present. If any of `Header`, `Namespace`, `Audience`, `Algo`/`VerificationKey`(or JWK source) are empty, it aggregates the missing field names and returns `required field missing in Dgraph.Authorization:<fields>`. The empty string after the colon lists exactly which fields are absent.

Source

Thrown at graphql/authorization/auth.go:104

		if a.VerificationKey == "" {
			fields = " `Verification key`/`JWKUrl`/`JWKUrls`"
		}

		if a.Algo == "" {
			fields += " `Algo`"
		}
	}

	if a.Header == "" {
		fields += " `Header`"
	}

	if a.Namespace == "" {
		fields += " `Namespace`"
	}

	if len(fields) > 0 {
		return fmt.Errorf("required field missing in Dgraph.Authorization:%s", fields)
	}
	return nil
}

func Parse(schema string) (*AuthMeta, error) {
	var meta AuthMeta
	authInfoIdx := strings.LastIndex(schema, AuthMetaHeader)
	if authInfoIdx == -1 {
		return nil, nil
	}
	authInfo := schema[authInfoIdx:]
	err := json.Unmarshal([]byte(authInfo[len(AuthMetaHeader):]), &meta)
	if err == nil {
		if err := meta.validate(); err != nil {
			return nil, err
		}

		if algoErr := meta.initSigningMethod(); algoErr != nil {

View on GitHub (pinned to 759e242be6)

Solutions

1. Read the field names appended after the colon in the message and add each missing key to the Dgraph.Authorization header
2. Add `Namespace` (the claim namespace, e.g. "https://dgraph.io/jwt/claims") if it's listed
3. Add `Audience` (array) matching your IDP's `aud` claim — required whenever JWKUrl/JWKUrls is set
4. Add `Header` (e.g. "X-Auth-Token" or Authorization) if listed; fix any key casing so JSON unmarshalling populates the fields

Example fix

// before
Dgraph.Authorization: {"JWKUrl":"https://idp/jwks.json","Audience":["dgraph"],"Algo":"RS256"}
// after
Dgraph.Authorization: {"JWKUrl":"https://idp/jwks.json","Namespace":"https://dgraph.io/jwt/claims","Audience":["dgraph"],"Algo":"RS256","Header":"X-Auth-Token"}

const auth = JSON.parse(process.env.DGRAPH_AUTHORIZATION);
for (const f of ['Namespace','Audience','Header','Algo']) {
  if (!auth[f] || (Array.isArray(auth[f]) && !auth[f].length)) {
    throw new Error(`required field missing in Dgraph.Authorization: ${f}`);
  }
}

const hasRequiredAuthFields = (a) => !!a.Namespace && !!a.Header && Array.isArray(a.Audience) && a.Audience.length > 0;

When it happens

Trigger: Calling Parse with a Dgraph.Authorization JSON that omits one or more required keys — most commonly `Namespace`, `Audience`, or `Header` — e.g. starting Dgraph with `Dgraph.Authorization: {"JWKUrl":"...","Algo":"RS256"}` with no Namespace.

Common situations: Typos in JSON keys ("namespace" lowercase) so the expected field reads as empty; partial configs copied from docs; forgetting Audience which is required when a JWKUrl is provided; switching IDPs and dropping fields.

Related errors

• expecting either JWKUrl or JWKUrls, both were given
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),
• audience value was expected but not provided
• jwt token cannot be validated because verification algorithm
• claims in jwt token is not map claims

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/a94cee987ec937b4. Report an issue: GitHub.