grpc/grpc-go · error

failed to create JWT call credentials: %v

Error message

failed to create JWT call credentials: %v

What it means

After validating the jwt_token_file path is non-empty, NewCallCredentials delegates to jwt.NewTokenFileCallCredentials (call_creds.go:49-51). If that function cannot open or parse the token file, it returns an error that is wrapped here. The underlying cause (e.g. file not found, invalid JWT format) is included.

Source

Thrown at internal/xds/bootstrap/jwtcreds/call_creds.go:51

// config must match the structure specified in gRFC A97.
//
// The caller is expected to invoke the cancel function when they are done using
// the returned call creds. This cancel function is idempotent.
func NewCallCredentials(configJSON json.RawMessage) (c credentials.PerRPCCredentials, cancel func(), err error) {
	var cfg struct {
		JWTTokenFile string `json:"jwt_token_file"`
	}
	emptyFn := func() {}

	if err := json.Unmarshal(configJSON, &cfg); err != nil {
		return nil, emptyFn, fmt.Errorf("failed to unmarshal JWT call credentials config: %v", err)
	}
	if cfg.JWTTokenFile == "" {
		return nil, emptyFn, fmt.Errorf("jwt_token_file is required in JWT call credentials config")
	}
	callCreds, err := jwt.NewTokenFileCallCredentials(cfg.JWTTokenFile)
	if err != nil {
		return nil, emptyFn, fmt.Errorf("failed to create JWT call credentials: %v", err)
	}
	return callCreds, emptyFn, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Confirm the token file exists at the configured path and is readable by the process.
2. Validate the file content is a well-formed JWT (three dot-separated base64 segments).
3. Check that the token-injecting sidecar or projected service-account token volume is mounted before the client initializes.
4. Inspect the wrapped error (%v) to distinguish file-not-found from parse errors.

Example fix

// before: jwt_token_file points to a path that doesn't exist yet
// after: ensure the projected token volume is mounted:
//   volumes:
//     - name: jwt-token
//       projected:
//         sources:
//           - serviceAccountToken:
//               path: token
//               audience: xds-server

// Verify the JWT token file exists and is a plausible JWT before creating creds.
func ensureJWTTokenFileReadable(path string) error {
    b, err := os.ReadFile(path)
    if err != nil {
        return err
    }
    parts := strings.Split(strings.TrimSpace(string(b)), ".")
    if len(parts) != 3 {
        return fmt.Errorf("%s does not look like a JWT (expected 3 dot-separated segments)", path)
    }
    return nil
}

// Capture and log the wrapped cause distinctly.
c, cancel, err := jwtcreds.NewCallCredentials(cfg)
if err != nil {
    return fmt.Errorf("jwt call creds unavailable; check token file: %w", err)
}

When it happens

Trigger: The jwt_token_file path is set but the file does not exist, is not readable, or does not contain a valid JWT. jwt.NewTokenFileCallCredentials reads the file and validates the token structure.

Common situations: The token file path is correct in config but the volume/secret was not mounted; the file exists but is empty or contains a placeholder string; the JWT expired-formatted token is malformed; permission mismatch between the injecting process and the consumer UID.

Related errors

• failed to unmarshal JWT call credentials config: %v
• jwt_token_file is required in JWT call credentials config
• token file access error
• %v: %w
• token file %q is empty: %w

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/f4523db77648af7c. Report an issue: GitHub.