grpc/grpc-go · error

jwt_token_file is required in JWT call credentials config

Error message

jwt_token_file is required in JWT call credentials config

What it means

After successfully unmarshalling the JWT call-credentials config, the library checks that jwt_token_file is non-empty (call_creds.go:46-47). A JWT call-credentials entry must point at a token file; an empty value means the configuration is incomplete and the credentials cannot be created.

Source

Thrown at internal/xds/bootstrap/jwtcreds/call_creds.go:47

	"google.golang.org/grpc/credentials/jwt"
)

// NewCallCredentials returns a new JWT token based call credentials. The input
// config must match the structure specified in gRFC A97.
//
// The caller is expected to invoke the cancel function when they are done using
// the returned call creds. This cancel function is idempotent.
func NewCallCredentials(configJSON json.RawMessage) (c credentials.PerRPCCredentials, cancel func(), err error) {
	var cfg struct {
		JWTTokenFile string `json:"jwt_token_file"`
	}
	emptyFn := func() {}

	if err := json.Unmarshal(configJSON, &cfg); err != nil {
		return nil, emptyFn, fmt.Errorf("failed to unmarshal JWT call credentials config: %v", err)
	}
	if cfg.JWTTokenFile == "" {
		return nil, emptyFn, fmt.Errorf("jwt_token_file is required in JWT call credentials config")
	}
	callCreds, err := jwt.NewTokenFileCallCredentials(cfg.JWTTokenFile)
	if err != nil {
		return nil, emptyFn, fmt.Errorf("failed to create JWT call credentials: %v", err)
	}
	return callCreds, emptyFn, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Add the jwt_token_file field with the absolute path to a readable JWT token file.
2. Verify the field name is exactly jwt_token_file (snake_case).
3. Ensure the token-injecting sidecar or secret mount populates the path before the app reads the bootstrap.
4. If JWT call creds are not needed, remove the entire call_credentials entry.

Example fix

// before:
//   { "type": "jwt", "config": {} }
// after:
//   { "type": "jwt", "config": { "jwt_token_file": "/var/run/secrets/jwt/token" } }

// Ensure jwt_token_file is present and non-empty.
func ensureJWTTokenFile(cfg json.RawMessage) error {
    var probe struct{ JWTTokenFile string `json:"jwt_token_file"` }
    if err := json.Unmarshal(cfg, &probe); err != nil {
        return err
    }
    if probe.JWTTokenFile == "" {
        return errors.New("jwt_token_file is required and must be non-empty")
    }
    return nil
}

When it happens

Trigger: The config JSON is valid but the jwt_token_file key is missing entirely or set to an empty string. This is a content-level validation distinct from the unmarshal error at index 326.

Common situations: The token file path was expected to be injected by a sidecar but the injection failed or the variable was empty; the field name was misspelled (e.g. jwt_file, token_file); the entry was scaffolded as a placeholder and never filled in.

Related errors

• failed to build credentials bundle from bootstrap for %q: %v
• failed to build call credentials from bootstrap for %q: %v
• xds: `channel_creds` field in server config cannot be empty:
• xds: required field `xds_servers` not found in bootstrap con
• failed to unmarshal JWT call credentials config: %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/11064f96c280dc96. Report an issue: GitHub.