hashicorp/nomad · warning

node does not have a JWT identity token

Error message

node does not have a JWT identity token

What it means

This ad-hoc error is returned by the client's node identity RPC endpoint (Get) when the Nomad client has no JWT identity token available. The comment notes clients can be upgraded before all servers, so the API may be invoked before a JWT identity exists. The endpoint deliberately returns an empty-string check before parsing to avoid parsing an empty token.

Source

Thrown at client/node_identity_endpoint.go:38

	return n
}

func (n *NodeIdentity) Get(args *structs.NodeIdentityGetReq, resp *structs.NodeIdentityGetResp) error {

	// Check for node read permissions.
	if aclObj, err := n.c.ResolveToken(args.AuthToken); err != nil {
		return err
	} else if !aclObj.AllowNodeRead() {
		return structs.ErrPermissionDenied
	}

	identityToken := n.c.nodeIdentityToken()

	// The client could be upgraded before all the servers allowing this API to
	// be called before it has a JWT identity. Check we do not get an empty
	// string before attempting to parse the token.
	if identityToken == "" {
		return errors.New("node does not have a JWT identity token")
	}

	// Parse the signed JWT token from the node identity and extract the claims
	// into a map. This is done to avoid exposing the key material of the signed
	// JWT token, but still results in all the claims which is perfect for
	// debugging and introspection purposes.
	parsedJWT, err := jwt.ParseSigned(identityToken)
	if err != nil {
		return fmt.Errorf("failed to parsed signed token: %w", err)
	}

	claims := make(map[string]any)

	if err := parsedJWT.UnsafeClaimsWithoutVerification(&claims); err != nil {
		return fmt.Errorf("failed to extract claims from token: %w", err)
	}

	resp.Claims = claims

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Upgrade the Nomad servers so they issue JWT identity tokens to clients
2. Enable/configure node identity on the cluster (identity block / server version support)
3. Check that the client actually has an identity token set before calling the endpoint
4. Retry after the client registers and receives its identity

tok := client.NodeIdentityToken()
if tok == "" { return errors.New("client has no JWT identity token yet") }

claims, err := endpoint.Get(ctx, req)
if err != nil && strings.Contains(err.Error(), "does not have a JWT identity token") {
    // fall back / wait for identity to be issued, then retry
    return nil, retryAfterIdentityReady
}

When it happens

Trigger: Calling the node identity Get endpoint when n.c.nodeIdentityToken() returns "" — i.e. the client is not configured with an identity/has not been issued one yet, typically due to client/server version skew.

Common situations: Debugging/introspection calls against a client whose node identity feature isn't enabled or whose servers predate the identity token API; a freshly upgraded client before servers issue identities.

Related errors

• failed to parsed signed token: %w
• node identity claims missing node pool
• failed to parse signed token: %w
• invalid signature: %w
• invalid claims: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/1dbb0a228d25f0b3. Report an issue: GitHub.