What causes "JWT authentication is not available" in nicolargo/glances?

Install the dependency: pip install 'glances[api]' (installs python-jose).

nicolargo/glances · error · RuntimeError

JWT authentication is not available

Error message

JWT authentication is not available

What it means

create_access_token() refuses to mint JWTs when the GlancesJWT instance is not backed by a usable secret — is_available is False because python-jose (or the secret) is missing. The RuntimeError surfaces when the REST API /api/4/token endpoint tries to generate a token, which instead reports HTTP 501 to clients.

Source

Thrown at glances/jwt_utils.py:73

    @property
    def expire_minutes(self) -> int:
        """Return the token expiration time in minutes."""
        return self._expire_minutes

    def create_access_token(self, username: str) -> str:
        """Create a JWT access token for the given username.

        Args:
            username: The username to encode in the token

        Returns:
            Encoded JWT token string

        Raises:
            RuntimeError: If JWT is not available
        """
        if not self.is_available:
            raise RuntimeError("JWT authentication is not available")

        expire = datetime.now(timezone.utc) + timedelta(minutes=self._expire_minutes)
        to_encode = {
            "sub": username,
            "exp": expire,
            "iat": datetime.now(timezone.utc),
            "iss": "glances",
        }
        return jwt.encode(to_encode, self._secret_key, algorithm=self.ALGORITHM)

    def verify_token(self, token: str) -> str | None:
        """Verify a JWT token and extract the username.

        Args:
            token: The JWT token to verify

        Returns:
            Username if valid, None otherwise

View on GitHub (pinned to a240d8dfb3)

Solutions

Install the dependency: pip install 'glances[api]' (installs python-jose).
Ensure a JWT secret exists — start Glances once with --password so the secret file is generated, or set it in the config under the appropriate section.
Verify afterwards with curl -X POST http://localhost:61208/api/4/token.

Example fix

# before
docker run glances
# 501 JWT authentication is not available

# after
docker run glances sh -c 'pip install "glances[api]" && glances -w --password'

Defensive patterns

Strategy: validation

Validate before calling

from glances.jwt_utils import GlancesJWT
jwt = GlancesJWT(config)
if not jwt.is_available:
    raise SystemExit('Install glances[api] / configure JWT secret before using /api/4/token')

Try / catch

try:
    token = jwt.create_access_token('user')
except RuntimeError:
    # JWT unavailable: fall back to basic auth for API access

Prevention

Install the [api] extra in deployment images.
Run once with --password to generate the secret.
Check is_available before enabling token-based tooling.

When it happens

Trigger: Running glances -w --password without the [jwt]/[api] secret configured, or without the python-jose extra installed; then POSTing to /api/4/token, whose _api_token handler calls create_access_token and this raises before the HTTP 501 mapping.

Common situations: Users enabling --password but skipping 'pip install glances[api]' (which pulls python-jose); first run where no JWT secret file was generated yet; container images built without the api extra.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of nicolargo/glances@a240d8dfb3 (2026-08-27). Data as JSON: /api/errors/647f59dfdc064c34. Report an issue: GitHub.