googleapis/mcp-toolbox · critical

no access JWT found in the response

Error message

no access JWT found in the response

What it means

The login response parsed successfully as JSON, but the data.accessJWT field is empty, so doLogin refuses to store a blank token. Dgraph omits accessJWT when authentication failed or the response is a valid-JSON error body. This converts a silently-empty credential into an explicit login failure.

Source

Thrown at internal/sources/dgraph/dgraph.go:331

	}

	if err := checkError(resp); err != nil {
		return err
	}

	var r struct {
		Data struct {
			AccessJWT  string `json:"accessJWT"`
			RefreshJWT string `json:"refreshJWT"`
		} `json:"data"`
	}

	if err := json.Unmarshal(resp, &r); err != nil {
		return fmt.Errorf("failed to unmarshal response: %v", err)
	}

	if r.Data.AccessJWT == "" {
		return fmt.Errorf("no access JWT found in the response")
	}
	if r.Data.RefreshJWT == "" {
		return fmt.Errorf("no refresh JWT found in the response")
	}

	hc.AccessJwt = r.Data.AccessJWT
	hc.RefreshToken = r.Data.RefreshJWT
	return nil
}

func (hc *DgraphClient) healthCheck() error {
	url, err := getUrl(hc.baseUrl, "/health", nil)
	if err != nil {
		return err
	}
	req, err := http.NewRequest(http.MethodGet, url, nil)
	if err != nil {
		return fmt.Errorf("error creating request: %w", err)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Verify the username and password (and reset_password/refresh token, if used) in the dgraph source config are correct for the ACL-enabled cluster.
2. Confirm ACL is actually enabled on the Dgraph cluster; on clusters without ACL, /login returns no JWTs.
3. Check the user exists and has appropriate permissions (e.g. is a guardian) via Dgraph's ACL user management.
4. Inspect the full login response body for an accompanying error message field explaining why no token was issued.
5. If using a refresh token flow, ensure the refresh token is valid and not expired.

Example fix

// before (config)
dgraph:
  baseURL: http://localhost:8080
  user: admin
  password: ""
// after
dgraph:
  baseURL: http://localhost:8080
  user: groot
  password: "<correct-acl-password>"

if user == "" || password == "" {
  return errors.New("dgraph ACL credentials (user/password) must be set before login")
}
// preflight ACL check
resp, _ := http.Get(baseURL + "/admin")
_ = resp // cluster must have ACL enabled for /login to return JWTs

func hasAccessToken(r loginResponse) bool { return r.Data.AccessJWT != "" }

if err := loginWithCredentials(ctx, user, pass); err != nil {
  if strings.Contains(err.Error(), "no access JWT") {
    // check credentials and that ACL is enabled on the cluster
    log.Printf("dgraph login rejected: verify ACL user/password: %v", err)
    return
  }
}

When it happens

Trigger: Dgraph /login returns JSON without an accessJWT field — typically wrong user/password/reset_password credentials, an ACL-enabled cluster where the user does not exist, or hitting an endpoint that does not perform ACL login (e.g. enterprise ACL features disabled).

Common situations: ACL credentials not configured or wrong in the source config; connecting to an Open Source Dgraph without ACL enabled (login is a no-op returning no tokens); typos in the username or password; user namespace mismatch (e.g. missing guardian user).

Related errors

• no refresh JWT found in the response
• failed to marshal credentials: %v
• failed to unmarshal response: %v
• client authorization is not supported
• failed to create keyfunc from JWKS URL %s: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/1a9a0e68d07dc920. Report an issue: GitHub.