hashicorp/nomad · error

invalid KeySource %q

Error message

invalid KeySource %q

What it means

Returned when validating an OIDC client assertion whose KeySource is not one of the supported enum values (e.g. nomad, private_key, client_secret). The default branch of the KeySource switch rejects any unrecognized string. It means the `key_source` field holds a typo or unsupported value.

Source

Thrown at nomad/structs/acl.go:1788

	}
	if len(c.Audience) == 0 || c.Audience[0] == "" {
		return errors.New("missing Audience")
	}
	switch c.KeySource {
	case OIDCKeySourceNomad:
	case OIDCKeySourcePrivateKey:
		if c.PrivateKey == nil {
			return errors.New("PrivateKey is required for `private_key` KeySource")
		}
		if err := c.PrivateKey.Validate(); err != nil {
			return fmt.Errorf("invalid PrivateKey: %w", err)
		}
	case OIDCKeySourceClientSecret:
		if c.ClientSecret == "" {
			return errors.New("OIDCClientSecret is required for `client_secret` KeySource")
		}
	default:
		return fmt.Errorf("invalid KeySource %q", c.KeySource)
	}
	return nil
}

type OIDCClientAssertionKeyIDHeader string

const (
	OIDCClientAssertionHeaderKid     OIDCClientAssertionKeyIDHeader = "kid"
	OIDCClientAssertionHeaderX5t     OIDCClientAssertionKeyIDHeader = "x5t"
	OIDCClientAssertionHeaderX5tS256 OIDCClientAssertionKeyIDHeader = "x5t#S256"
)

// OIDCClientAssertionKey contains key material provided by users for Nomad
// to use to sign the private key JWT.
// See api.OIDCClientAssertionKey for full field descriptions.
type OIDCClientAssertionKey struct {
	PemKey     string
	PemKeyFile string

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Set key_source to one of the supported values: "nomad", "private_key", or "client_secret".
2. Check spelling and lowercase casing of the value.
3. Confirm your Nomad version supports the chosen KeySource (nomad version / docs).

Example fix

// before
key_source = "privte_key"

// after
key_source = "private_key"

var validKeySources = map[string]bool{"nomad": true, "private_key": true, "client_secret": true}
if !validKeySources[assertion.KeySource] {
    return fmt.Errorf("key_source %q not supported; use nomad, private_key, or client_secret", assertion.KeySource)
}

func isValidKeySource(s string) bool {
    switch s {
    case "nomad", "private_key", "client_secret":
        return true
    }
    return false
}

When it happens

Trigger: Creating/updating an OIDC provider auth method with OIDCClientAssertion.KeySource set to anything outside the defined OIDCKeySource* constants, such as "keys", "jwt", "" (empty), or a mis-cased "Private_Key".

Common situations: Typo in key_source value; copying config from Vault or another OIDC integration that uses different KeySource names; upgrading Nomad and using a value not yet supported.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• missing OIDCDiscoveryURL
• missing OIDCClientID
• missing auth method name
• missing client nonce
• missing redirect URI

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/0eb90102a812fbd6. Report an issue: GitHub.