dgraph-io/dgraph · error

required field missing in Dgraph.Authorization

Error message

required field missing in Dgraph.Authorization:%s

What it means

Dgraph's `validate` checks that the mandatory AuthMeta fields are present. If any of `Header`, `Namespace`, `Audience`, `Algo`/`VerificationKey`(or JWK source) are empty, it aggregates the missing field names and returns `required field missing in Dgraph.Authorization:<fields>`. The empty string after the colon lists exactly which fields are absent.

Solutions

1. Read the field names appended after the colon in the message and add each missing key to the Dgraph.Authorization header
2. Add `Namespace` (the claim namespace, e.g. "https://dgraph.io/jwt/claims") if it's listed
3. Add `Audience` (array) matching your IDP's `aud` claim — required whenever JWKUrl/JWKUrls is set
4. Add `Header` (e.g. "X-Auth-Token" or Authorization) if listed; fix any key casing so JSON unmarshalling populates the fields

Example fix

// before
Dgraph.Authorization: {"JWKUrl":"https://idp/jwks.json","Audience":["dgraph"],"Algo":"RS256"}
// after
Dgraph.Authorization: {"JWKUrl":"https://idp/jwks.json","Namespace":"https://dgraph.io/jwt/claims","Audience":["dgraph"],"Algo":"RS256","Header":"X-Auth-Token"}

const auth = JSON.parse(process.env.DGRAPH_AUTHORIZATION);
for (const f of ['Namespace','Audience','Header','Algo']) {
  if (!auth[f] || (Array.isArray(auth[f]) && !auth[f].length)) {
    throw new Error(`required field missing in Dgraph.Authorization: ${f}`);
  }
}

const hasRequiredAuthFields = (a) => !!a.Namespace && !!a.Header && Array.isArray(a.Audience) && a.Audience.length > 0;

When it happens

Trigger: Calling Parse with a Dgraph.Authorization JSON that omits one or more required keys — most commonly `Namespace`, `Audience`, or `Header` — e.g. starting Dgraph with `Dgraph.Authorization: {"JWKUrl":"...","Algo":"RS256"}` with no Namespace.

Common situations: Typos in JSON keys ("namespace" lowercase) so the expected field reads as empty; partial configs copied from docs; forgetting Audience which is required when a JWKUrl is provided; switching IDPs and dropping fields.

Related errors

• audience value was expected but not provided
• claims in jwt token is not map claims
• claims in jwt token is not map claims
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo)…
• expecting either JWKUrl or JWKUrls, both were given

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/a94cee987ec937b4. Report an issue: GitHub.

Appendix: source

Thrown at graphql/authorization/auth.go:104

		if a.VerificationKey == "" {
			fields = " `Verification key`/`JWKUrl`/`JWKUrls`"
		}

		if a.Algo == "" {
			fields += " `Algo`"
		}
	}

	if a.Header == "" {
		fields += " `Header`"
	}

	if a.Namespace == "" {
		fields += " `Namespace`"
	}

	if len(fields) > 0 {
		return fmt.Errorf("required field missing in Dgraph.Authorization:%s", fields)
	}
	return nil
}

func Parse(schema string) (*AuthMeta, error) {
	var meta AuthMeta
	authInfoIdx := strings.LastIndex(schema, AuthMetaHeader)
	if authInfoIdx == -1 {
		return nil, nil
	}
	authInfo := schema[authInfoIdx:]
	err := json.Unmarshal([]byte(authInfo[len(AuthMetaHeader):]), &meta)
	if err == nil {
		if err := meta.validate(); err != nil {
			return nil, err
		}

		if algoErr := meta.initSigningMethod(); algoErr != nil {

View on GitHub (pinned to 759e242be6)