invoke-ai/InvokeAI · critical · RuntimeError

JWT secret has not been initialized. Call set_jwt_secret() d

Error message

JWT secret has not been initialized. Call set_jwt_secret() during application startup.

What it means

The token_service module keeps a module-level _jwt_secret that must be populated via set_jwt_secret() at application startup. get_jwt_secret() raises this RuntimeError whenever token creation or verification is attempted before that initialization, since signing/verifying with a None secret is impossible.

Source

Thrown at invokeai/app/services/auth/token_service.py:56

    Args:
        secret: The JWT secret key
    """
    global _jwt_secret
    _jwt_secret = secret


def get_jwt_secret() -> str:
    """Get the JWT secret key.

    Returns:
        The JWT secret key

    Raises:
        RuntimeError: If the secret has not been initialized
    """
    if _jwt_secret is None:
        raise RuntimeError("JWT secret has not been initialized. Call set_jwt_secret() during application startup.")
    return _jwt_secret


def create_access_token(data: TokenData, expires_delta: timedelta | None = None) -> str:
    """Create a JWT access token.

    Args:
        data: The token data to encode
        expires_delta: Optional expiration time delta. Defaults to 24 hours.

    Returns:
        The encoded JWT token
    """
    to_encode = data.model_dump()
    expire = datetime.now(timezone.utc) + (expires_delta or timedelta(hours=DEFAULT_EXPIRATION_HOURS))
    to_encode.update({"exp": expire})
    return cast(str, jwt.encode(to_encode, get_jwt_secret(), algorithm=ALGORITHM))

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Ensure set_jwt_secret() (with the secret from app_settings.get_jwt_secret()) is called during application startup before any auth call
2. In tests/scripts, call set_jwt_secret() in fixtures/setup before using create_access_token or verify_token
3. Check startup logs for a failure that prevented initialization; fix the earlier exception so the secret gets set

Example fix

// before
token = create_access_token(data)  # RuntimeError: secret not initialized
// after
set_jwt_secret(app_settings.get_jwt_secret())
token = create_access_token(data)

import invokeai.app.services.auth.token_service as ts
assert ts._jwt_secret is not None, "call set_jwt_secret() before using token_service"

try:
    token = create_access_token(data)
except RuntimeError as e:
    if 'set_jwt_secret' in str(e):
        set_jwt_secret(app_settings.get_jwt_secret())
        token = create_access_token(data)
    else:
        raise

When it happens

Trigger: Calling create_access_token() or verify_token() before the app startup hook invoked set_jwt_secret(); running auth code in tests or scripts that bypass application startup; an exception during startup that skipped secret initialization.

Common situations: Unit-testing token endpoints without the startup fixture; calling auth utilities from a background worker or CLI that never runs app startup; startup ordering bug where auth routes initialize before the secret is set.

Related errors

• JWT secret not found in database. This should have been crea
• Not authorized to modify this image
• Not authorized to access this image
• Not authorized to access this board
• Invalid or expired token

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/a9d3c315494f9364. Report an issue: GitHub.