googleapis/mcp-toolbox · error

failed to create keyfunc from JWKS URL %s: %w

Error message

failed to create keyfunc from JWKS URL %s: %w

What it means

This error is returned when the keyfunc library (github.com/MicahParks/keyfunc/v3) cannot initialize a JWKS-based key lookup from the discovered jwks_uri. keyfunc.NewDefault validates the JWKS URL(s) and starts background refresh; an unparseable or structurally invalid URL causes initialization to fail before the auth service is constructed.

Source

Thrown at internal/auth/generic/generic.go:94

		}
	}
	httpClient := newSecureHTTPClient()

	// Discover OIDC endpoints
	jwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)
	if err != nil {
		return nil, fmt.Errorf("failed to discover OIDC config: %w", err)
	}

	// Override introspection URL if configured
	if cfg.IntrospectionEndpoint != "" {
		introspectionURL = cfg.IntrospectionEndpoint
	}

	// Create the keyfunc to fetch and cache the JWKS in the background
	kf, err := keyfunc.NewDefault([]string{jwksURL})
	if err != nil {
		return nil, fmt.Errorf("failed to create keyfunc from JWKS URL %s: %w", jwksURL, err)
	}

	a := &AuthService{
		Config:           cfg,
		kf:               kf,
		client:           httpClient,
		introspectionURL: introspectionURL,
		issuer:           issuer,
	}
	return a, nil
}

func newSecureHTTPClient() *http.Client {
	return &http.Client{
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          10,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. curl <authorizationServer>/.well-known/openid-configuration and inspect the jwks_uri value
2. Ensure the provider advertises an absolute https jwks_uri (e.g. https://auth.example.com/.well-known/jwks.json)
3. If the provider is non-compliant, fix its OIDC discovery document or switch providers
4. Check the wrapped keyfunc error for the exact URL validation failure

u, err := url.Parse(discoveredJwksURL)
if err != nil || (u.Scheme != "https" && u.Scheme != "http") || u.Host == "" {
    return fmt.Errorf("discovered jwks_uri %q is not a usable absolute URL", discoveredJwksURL)
}
if _, err := keyfunc.NewDefault([]string{discoveredJwksURL}); err != nil {
    return fmt.Errorf("keyfunc init would fail: %w", err)
}

kf, err := keyfunc.NewDefault([]string{jwksURL})
if err != nil {
    log.Printf("JWKS URL %q rejected by keyfunc: %v", jwksURL, err)
    return err
}

When it happens

Trigger: keyfunc.NewDefault([]string{jwksURL}) fails during Initialize() because the jwks_uri discovered from the OIDC config document is not a valid/parseable URL (e.g. relative URL, malformed scheme).

Common situations: A misconfigured or non-compliant authorization server advertises a jwks_uri that is not an absolute http(s) URL; or discovery returned a placeholder/invalid value.

Related errors

• jwks_uri not found in config
• invalid jwks_uri detected
• failed to discover OIDC config: %w
• failed to fetch OIDC config: %w
• unexpected status: %d

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/bc43066d0c50281e. Report an issue: GitHub.