infiniflow/ragflow · error · Exception

JWT secret not configured

Error message

JWT secret not configured

What it means

Error "JWT secret not configured" thrown in infiniflow/ragflow.

Source

Thrown at api/apps/restful_apis/agent_api.py:2041

        if provided != token_value:
            raise Exception("Invalid token authentication")

    def _validate_basic_auth(security_cfg):
        """Validate HTTP Basic Auth credentials."""
        auth_cfg = security_cfg.get("basic_auth", {})
        username = auth_cfg.get("username")
        password = auth_cfg.get("password")

        auth = request.authorization
        if not auth or auth.username != username or auth.password != password:
            raise Exception("Invalid Basic Auth credentials")

    def _validate_jwt_auth(security_cfg):
        """Validate JWT token in Authorization header."""
        jwt_cfg = security_cfg.get("jwt", {})
        secret = jwt_cfg.get("secret")
        if not secret:
            raise Exception("JWT secret not configured")

        auth_header = request.headers.get("Authorization", "")
        if not auth_header.startswith("Bearer "):
            raise Exception("Missing Bearer token")

        token = auth_header[len("Bearer ") :].strip()
        if not token:
            raise Exception("Empty Bearer token")

        alg = (jwt_cfg.get("algorithm") or "HS256").upper()

        decode_kwargs = {
            "key": secret,
            "algorithms": [alg],
        }
        options = {}
        if jwt_cfg.get("audience"):
            decode_kwargs["audience"] = jwt_cfg["audience"]

View on GitHub (pinned to 554fb1133a)

Solutions

1. Configure a JWT secret in the webhook auth settings.
2. Switch to another auth_type if JWT is not intended.

Example fix

webhook_config = {'auth_type': 'jwt', 'jwt_secret': '<random-secret>'}

When it happens

Trigger: Thrown at api/apps/restful_apis/agent_api.py:2041 when the library encounters an invalid state.

Common situations: The webhook uses JWT auth but no signing secret is configured server-side; setting the secret prevents this error.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/fdb781594bf1ebd0. Report an issue: GitHub.