dgraph-io/dgraph · error

while getting jwt auth token

Error message

while getting jwt auth token

What it means

upgradePersitentQuery calls getAccessJwt to obtain a JWT before touching persisted queries. If that fails, the error is wrapped as 'while getting jwt auth token'. The upgrade tool could not authenticate against the /graphql or /health endpoint to get an access token.

Source

Thrown at upgrade/change_v21.03.0.go:151

		op := &api.Operation{
			DropOp:    api.Operation_TYPE,
			DropValue: typ,
		}
		if err := alterWithClient(dg, op); err != nil {
			return errors.Wrapf(err, "error deleting old type %s", typ)
		}
	}
	fmt.Println("Successfully dropped the deprecated predicates")
	return nil
}

func upgradePersitentQuery() error {
	dg, cb := x.GetDgraphClient(Upgrade.Conf, hasAclCreds())
	defer cb()

	jwt, err := getAccessJwt()
	if err != nil {
		return errors.Wrap(err, "while getting jwt auth token")
	}

	// Get persisted queries.
	queryData := make(map[string][]pquery)
	if err := getQueryResult(dg, queryPersistedQuery_v21_03_0, &queryData); err != nil {
		return errors.Wrap(err, "error querying persisted queries")
	}

	// Update the schema with new indexer for persisted query.
	updatedSchema := `
		<dgraph.graphql.p_query>: string @index(sha256) .
		type <dgraph.graphql.persisted_query> {
			<dgraph.graphql.p_query>
		}
			`
	if err := alterWithClient(dg, &api.Operation{Schema: updatedSchema}); err != nil {
		return fmt.Errorf("error updating the schema for persistent query, %w", err)
	}

View on GitHub (pinned to 759e242be6)

Solutions

1. Pass correct ACL credentials (or omit hasAclCreds if ACL is disabled) to the upgrade command.
2. Verify the Dgraph Zero/Alpha endpoints are reachable with curl before running the upgrade.
3. Check for TLS config mismatch and supply the right CA/certs.
4. Confirm the ACL user has the admin group permission.

Example fix

// before
Upgrade.Upgrade "--acls" missing creds
// after
dgraph upgrade --acls "user:password" ... (correct admin ACL creds)

curl -s -XPOST http://localhost:8080/graphql -d '{"query":"mutation { login(userId:\"groot\", password:\"password\"){ accessJWT }}"}'  # confirm creds work before upgrade

jwt, err := getAccessJwt()
if err != nil {
	return errors.Wrap(err, "while getting jwt auth token")
}

When it happens

Trigger: getAccessJwt returns an error — wrong username/password for ACL, ACL not enabled but creds supplied (or vice versa), or the login endpoint is unreachable.

Common situations: ACL credentials not passed or mistyped on the upgrade command line; cluster reachable but authentication endpoint misconfigured; TLS/certificate mismatch preventing login.

Related errors

• Authorize guardian of the galaxy, extracting jwt token, erro
• error querying old ACL rules: %w
• unable to parse ACLs: %v
• unable to unmarshal ACL: %v :: %w
• error upgrading ACL rules: %w

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/067263f09e304b17. Report an issue: GitHub.