googleapis/mcp-toolbox · error

jwks_uri not found in config

Error message

jwks_uri not found in config

What it means

The discovery document parsed fine and contained an issuer, but the 'jwks_uri' field was empty or missing. The jwks_uri is required to fetch the signing keys used for JWT verification, so initialization cannot continue without it.

Source

Thrown at internal/auth/generic/generic.go:167

	if err != nil {
		return "", "", "", err
	}

	var config struct {
		Issuer                string `json:"issuer"`
		JwksUri               string `json:"jwks_uri"`
		IntrospectionEndpoint string `json:"introspection_endpoint"`
	}
	if err := json.Unmarshal(body, &config); err != nil {
		return "", "", "", err
	}

	if config.Issuer == "" {
		return "", "", "", fmt.Errorf("issuer not found in config")
	}

	if config.JwksUri == "" {
		return "", "", "", fmt.Errorf("jwks_uri not found in config")
	}

	// Sanitize the resulting JWKS URI before returning it
	parsedJWKS, err := url.Parse(config.JwksUri)
	if err != nil {
		return "", "", "", fmt.Errorf("invalid jwks_uri detected")
	}
	if parsedJWKS.Scheme != "https" {
		log.Printf("WARNING: HTTP instead of HTTPS is being used for JWKS URI: %s", config.JwksUri)
	}

	return config.JwksUri, config.IntrospectionEndpoint, config.Issuer, nil
}

var _ auth.MCPAuthService = AuthService{}

// struct used to store auth service info
type AuthService struct {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. curl the discovery URL and confirm "jwks_uri" is present and non-empty
2. Use a spec-compliant OIDC provider or fix the provider's discovery document
3. Ensure you are hitting the real discovery endpoint and not a stub/mock
4. If the provider serves keys at a known path but omits discovery, switch to an auth config that accepts an explicit JWKS URL

var doc struct{ JwksUri string `json:"jwks_uri"` }
json.NewDecoder(resp.Body).Decode(&doc)
if doc.JwksUri == "" {
    return fmt.Errorf("discovery doc has no jwks_uri; provider not supported by generic auth")
}

_, err := cfg.Initialize()
if err != nil && strings.Contains(err.Error(), "jwks_uri not found in config") {
    log.Fatalf("auth provider discovery lacks jwks_uri; switch providers or configure keys explicitly: %v", err)
}

When it happens

Trigger: json.Unmarshal of the discovery body succeeds, config.Issuer is set, but config.JwksUri == "" — the provider's discovery document omits jwks_uri.

Common situations: Minimal or partially-compliant OIDC providers that omit jwks_uri; misconfigured auth middleware serving a trimmed discovery doc; a spoofed/incorrect discovery endpoint.

Related errors

• failed to create keyfunc from JWKS URL %s: %w
• issuer not found in config
• invalid jwks_uri detected
• failed to discover OIDC config: %w
• failed to fetch OIDC config: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/89c9571e9377940b. Report an issue: GitHub.