hashicorp/nomad · error

ErrNoKeyID

ErrNoKeyID

Error message

missing key ID header

What it means

ErrNoKeyID is a sentinel error returned by joseutil.KeyID when a parsed JWT has no `kid` (key ID) JOSE header. Vault uses the kid to look up which verification key to use, so a token without one cannot be processed.

Source

Thrown at helper/joseutil/joseutil.go:12

// Copyright IBM Corp. 2015, 2026
// SPDX-License-Identifier: BUSL-1.1

package joseutil

import (
	"errors"

	"github.com/go-jose/go-jose/v3/jwt"
)

var ErrNoKeyID = errors.New("missing key ID header")

// KeyID returns the KeyID header for a JWT or ErrNoKeyID if a key id could not
// be found. No clue why jose makes this so awkward.
func KeyID(token *jwt.JSONWebToken) (string, error) {
	for _, h := range token.Headers {
		if h.KeyID != "" {
			return h.KeyID, nil
		}
	}
	return "", ErrNoKeyID
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Re-issue the JWT ensuring the signing library sets the `kid` header (e.g. jose.SignerOption with jose.Header("kid", keyID)).
2. If you control the flow, treat ErrNoKeyID explicitly with errors.Is and fall back to single-key verification or reject the token early with a clear client-side message.
3. Check the identity provider configuration to ensure key rotation includes kid in the JWKS.

Example fix

// before
kid, err := joseutil.KeyID(token) // ErrNoKeyID
// after
kid, err := joseutil.KeyID(token)
if errors.Is(err, joseutil.ErrNoKeyID) {
    return fmt.Errorf("token lacks kid header; configure the issuer to include it")
}

// no pre-call validation possible; inspect headers yourself if desired
func hasKid(token *jwt.JSONWebToken) bool {
    for _, h := range token.Headers {
        if h.KeyID != "" { return true }
    }
    return false
}

func tokenHasKeyID(headers []jose.Header) bool {
    for _, h := range headers {
        if h.KeyID != "" { return true }
    }
    return false
}

kid, err := joseutil.KeyID(token)
if errors.Is(err, joseutil.ErrNoKeyID) {
    // reject token or fall back to single-key verification
    return nil, fmt.Errorf("JWT missing kid header")
}

When it happens

Trigger: Calling joseutil.KeyID(token *jwt.JSONWebToken) on a token whose headers contain no non-empty KeyID field — i.e. a JWT signed/published without the kid header.

Common situations: OIDC providers or JWKS endpoints that omit the kid header; hand-crafted JWTs in integration tests; tokens minted by libraries that don't set kid when a single key is in use.

Related errors

• no auth method config or client assertion
• missing login token
• failed to login with JWT: %v
• failed to parse signed token: %w
• invalid signature: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/cd0d20a4b2d00684. Report an issue: GitHub.