micro/go-micro · error

ErrEncodingToken

ErrEncodingToken

Error message

error encoding the token

What it means

ErrEncodingToken (message "error encoding the token") is returned by Provider.Generate in auth/jwt/token when the token cannot be serialized/encoded into a JWT. The declared sentinel is returned whenever the underlying encode step fails inside Generate, so callers can distinguish encoding failure from lookup or inspect errors.

Solutions

1. Check the provider's key configuration (private key env var/option) is present and valid PEM before calling Generate
2. Validate the key can parse/sign by running a minimal Generate in a startup health check
3. Ensure the account/claims being encoded contain only serializable values
4. Pin/upgrade the jwt dependency if an algorithm incompatibility was introduced

Example fix

// before: provider built with an empty private key, Generate fails with ErrEncodingToken
p := token.NewProvider() // no key configured
p.Generate(account)
// after: configure a valid key up front and fail fast at startup
p := token.NewProvider(token.WithPrivateKey(signingKey))
if _, err := p.Generate(account); err != nil { log.Fatalf("token signing misconfigured: %v", err) }

// validate signing key at startup before any Generate call
func validateKey(pem string) error {
    if strings.TrimSpace(pem) == "" { return errors.New("JWT signing key is empty") }
    if !strings.Contains(pem, "-----BEGIN") { return errors.New("JWT signing key is not PEM encoded") }
    return nil
}
if err := validateKey(os.Getenv("JWT_PRIVATE_KEY")); err != nil { log.Fatal(err) }

func isEncodingError(err error) bool {
    return errors.Is(err, token.ErrEncodingToken)
}

tok, err := provider.Generate(account)
if err != nil {
    if errors.Is(err, token.ErrEncodingToken) {
        return fmt.Errorf("token encoder misconfigured, check signing key: %w", err)
    }
    return err
}

When it happens

Trigger: Provider.Generate is called and the internal encoding (e.g. JWT claims serialization or signing) returns an error, most commonly an invalid or missing signing key configured on the provider.

Common situations: JWT_PRIVATE_KEY / signing key env var unset or malformed so the encoder is misconfigured; key file unreadable at runtime; using a key algorithm unsupported by the encoding path after a library version change.

Related errors

• ap2: invalid signature encoding
• ap2: mandate id is required
• ap2: mandate kind is required
• ErrEncodingMessage
• ErrInvalidToken

AI-assisted analysis of micro/go-micro@24529f1404 (2026-09-01). Data as JSON: /api/errors/0b2db8c3fc248a1c. Report an issue: GitHub.

Appendix: source

Thrown at auth/jwt/token/token.go:14

package token

import (
	"errors"
	"time"

	"go-micro.dev/v6/auth"
)

var (
	// ErrNotFound is returned when a token cannot be found.
	ErrNotFound = errors.New("token not found")
	// ErrEncodingToken is returned when the service encounters an error during encoding.
	ErrEncodingToken = errors.New("error encoding the token")
	// ErrInvalidToken is returned when the token provided is not valid.
	ErrInvalidToken = errors.New("invalid token provided")
)

// Provider generates and inspects tokens.
type Provider interface {
	Generate(account *auth.Account, opts ...GenerateOption) (*Token, error)
	Inspect(token string) (*auth.Account, error)
	String() string
}

type Token struct {
	// The actual token
	Token string `json:"token"`
	// Time of token creation
	Created time.Time `json:"created"`
	// Time of token expiry
	Expiry time.Time `json:"expiry"`

View on GitHub (pinned to 24529f1404)