ErrLookup › ory/hydra
ory/hydra
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go. · Go · 664 source files
Analyzed at 4174065ffb on 2026-09-03. 255 documented errors.
| Code / Message | Type | Severity | Tags |
|---|---|---|---|
| issuer URL must be set unless development mode is enabled | validation | error | config, oauth2, hydra, startup |
| issuer URL scheme must be HTTPS unless development mode is e | validation | error | config, https, tls, oauth2 |
| global secret is not configured | validation | critical | config, secrets, hydra, startup |
| global secret is too short | validation | critical | config, secrets, security, hydra |
| The DSN connection string looks like a SQLite connection, bu | validation | error | database, sqlite, dsn, hydra |
| unsupported DSN type | validation | error | database, dsn, config, hydra |
| failed to set token lifespans due to failed client type asse | exception | error | fosite, oauth2, type-assertion, storage |
| a secret for signing HMAC-SHA512/256 is expected to be defin | validation | critical | fosite, hmac, secrets, oauth2 |
| header, body and signature must all be set | validation | error | jwt, fosite, malformed-token, parsing |
| Token is expired | validation | warning | jwt, token-expired, fosite, validation |
| Token used before issued | validation | error | jwt, oauth2, clock-skew, validation |
| Token is not valid yet | validation | error | jwt, oauth2, clock-skew, validation |
| Hardware Security Module is not supported on this platform. | exception | critical | hsm, pkcs11, build-config, hydra |
| key not found | validation | error | jwks, jose, oauth2, keys |
| Only access tokens are allowed in the authorization header. | http | error | oauth2, oidc, userinfo, access-token |
| command expects one argument which is the path to the output | validation | warning | cli, cobra, argument-error, documentation |
| cookiex: cookie could not be decoded | validation | error | cookies, go, session, encoding |
| cookiex: purpose must be non-empty and must not contain a pi | validation | error | cookies, go, validation, configuration |
| cookiex: at least one secret is required | validation | error | cookies, go, configuration, crypto |
| cookiex: max age must not be negative | validation | error | cookies, configuration, validation |
| cookiex: legacy encode requires legacy key pairs | validation | error | cookies, configuration, legacy, keys |
| cookiex: payload must be a flat JSON object with string valu | validation | error | cookies, json, legacy, type-mismatch |
errKeyNotFound key not found | validation | error | http, forms, decoding, validation |
ErrUnknownHashAlgorithm unknown hash algorithm | exception | error | passwords, hashing, crypto, migration |
ErrInvalidHash the encoded hash is not in the correct format | validation | error | passwords, hashing, crypto, format |
ErrIncompatibleVersion incompatible version of argon2 | validation | error | passwords, hashing, argon2, version-compatibility |
ErrMismatchedHashAndPassword passwords do not match | validation | warning | passwords, hashing, authentication, crypto |
| DNS lookup timed out | exception | error | dns, network, timeout, ssrf |
| no route to host | exception | error | network, ssrf, dial, security |
| invalid elliptic curve key size, this algorithm does not sup | validation | error | go, jose, crypto, ecdsa, key-generation |
| invalid key size for RSA key, 2048 or more is required | validation | error | go, jose, crypto, rsa, key-generation |
| invalid elliptic curve key size, use one of 256, 384, or 521 | validation | error | go, jose, crypto, ecdh, jwe, key-generation |
| invalid JWK key | validation | error | go, jose, jwk, key-parsing, validation |
| priv/pub JWK key mismatch | validation | error | jwk, crypto, key-mismatch, configuration |
ErrNoProcessPool jsonnetsecure: a process pool is required; use MakeInProcessVM to evaluate in th | exception | error | jsonnet, process-isolation, nil-argument, api-misuse |
ErrProcessPoolClosed jsonnetsecure: process pool closed | exception | error | jsonnet, process-pool, lifecycle, use-after-close |
| newWorker: missing binary path in context | exception | error | jsonnet, process-pool, missing-context-value, internal-invariant |
| errors.New(err) | exception | warning | jsonnet, snippet-evaluation, stderr, user-input |
| jsonnetsecure: " + result | exception | error | jsonnet, evaluation, sandbox |
ErrUnableToFindKeyID specified JWK kid can not be found in the JWK sets | exception | error | jwks, jwt, key-lookup |
| jwt from authorization HTTP header is missing value for "kid | http | error | jwt, middleware, http-header |
| message not found | exception | warning | mailhog, in-memory-store, not-found |
ErrKeyDoesNotExist key is not present in map | validation | warning | maps, type-assertion, sentinel-error |
ErrKeyCanNotBeTypeAsserted key could not be type asserted | validation | error | go, type-assertion, mapx, jwt-claims |
| value is out of range | validation | error | go, range-overflow, time, mapx |
| file loader disabled | validation | error | go, osx, file-io, security, configuration |
| http(s) loader disabled | validation | error | go, osx, http, security, configuration |
| base64 loader disabled | validation | error | |
ErrUnknownOrder unknown order | validation | error | |
| ciphertext too short | validation | error | |
| plan must define at least one PageTokenColumn | validation | error | |
| plan must define at least one ApplicableQueries | validation | error | |
| plan must define a DefaultPageToken | validation | error | go, pagination, configuration |
| unsupported dialect | error_code | warning | go, database, migrations, dialect |
| the provided region is not a valid Ory region | validation | error | go, validation, region, configuration |
| the provided region is not allowed by this project's home re | validation | error | go, region, permissions, configuration |
| invalid DSN: missing scheme separator | validation | error | go, dsn, database, validation |
| invalid DSN: empty scheme | validation | error | go, dsn, database, validation |
| no tls configuration was found | error_code | error | go, tls, configuration, certificates |
| tls configuration is invalid | error_code | error | go, tls, configuration, certificates |
| can not serve request over insecure http | http | error | go, http, tls, middleware, proxy |
| key must be exactly %d bytes long, got %d bytes | validation | critical | encryption, aead, configuration, key-management |
| at least one encryption key must be defined but none were | validation | critical | encryption, aead, configuration, key-management |
| plaintext too large | exception | error | encryption, aead, size-limit |
| malformed ciphertext: too short | exception | error | encryption, aead, decryption, data-corruption |
| A DSN is required as a positional argument when not passing | console | error | cli, configuration, janitor, arguments |
| Janitor requires at least one of --tokens, --requests or --g | console | error | cli, janitor, arguments |
| Values for --limit and --batch-size should both be greater t | console | error | cli, janitor, arguments, validation |
| Value for --batch-size must not be greater than value for -- | console | error | cli, janitor, arguments, validation |
| When using flag -e, environment variable DSN must be set. Wh | console | error | cli, configuration, janitor, dsn, env |
| unable to open file %q: %w | console | error | cli, file-io, filesystem |
| unable to decode JSON: %w | console | error | cli, json, parsing |
| could not start debug server on port %d: %w | console | error | network, port-binding, cli |
| could not set GOMAXPROCS: %w | console | error | golang, cgroups, startup, configuration |
| unable to cast %#v of type %T to []float64 | error_code | warning | casting, golang, nil-value |
| unable to load TLS certificate for interface %s: %w | error_code | critical | tls, configuration, base64 |
| %w: in source %q: allowed schemes: %s | error_code | error | fetcher, url, scheme, configuration |
| %s content encoding not supported | http | error | http, middleware, content-encoding, go |
| unknown algorithm %s for signing key | error_code | error | jose, jwk, crypto, go |
| unknown algorithm %s for encryption key | error_code | error | jose, jwk, crypto, encryption, go |
| square/go-jose: parse error, got '%s', '%s' and '%s' | error_code | error | jose, jwk, pem, key-parsing, go |
| square/go-jose: parse error, got '%s', '%s', '%s' and '%s' | error_code | error | jose, jwk, pem, key-parsing, go |
| import not available %v | error_code | error | jsonnet, import, sandbox, go |
| failed to set virtual memory limit: %v | error_code | error | unix, rlimit, memory, syscall, go |
| jwt from authorization HTTP header is expecting string value | http | error | jwt, jwks, kid, auth, go |
| database error on committing or rolling back transaction: %w | error_code | error | database, transaction, commit, rollback, go |
| unable to scan type %T as JSON into %T | error_code | error | json, database, scan, type-mismatch |
| unable to decode JSON payload into %T: %w | error_code | error | json, unmarshal, database, decoding |
| unable to base64 decode the TLS certificate: %v | error_code | error | tls, base64, certificate, configuration |
| unable to base64 decode the TLS private key: %v | error_code | error | tls, base64, private-key, configuration |
| unable to load X509 key pair: %v | error_code | error | tls, x509, certificate, key-mismatch |
| unable to load X509 key pair from files: %v | error_code | error | tls, x509, file-not-found, certificate |
| file watch: %v | error_code | warning | tls, file-watcher, filesystem, inotify |
| watcher is not running | error_code | error | watcher, lifecycle, context-cancelled |
| key must be exactly 32 long bytes, got %d bytes | error_code | error | crypto, aead, aes-gcm, key-length |
| Could not create driver | console | error | cli, database, driver, janitor, configuration |
| %s %s %s When using flag -e, environment variable DSN must | console | error | cli, configuration, dsn, janitor, missing-env-var |
| Could not cleanup inactive %s | console | error | cli, database, janitor, cleanup, batch-delete |
| failed to encode JSON Web Key Set | console | error | jwk, json, serialization, sdk |
| failed to decode JSON Web Key Set | console | error | jwk, json, deserialization, sdk |
| migrations have not yet been fully applied: %+v | error_code | error | database, migrations, startup, schema |
| invalid flow state: expected one of %v, got %d | error_code | error | oauth2, oidc, flow-state, state-machine |
| flow Subject %s does not match the HandledLoginRequest Subje | error_code | error | oauth2, oidc, hydra, login-flow, subject-mismatch |
| flow ForceSubjectIdentifier %s does not match the HandledLog | error_code | error | oauth2, oidc, hydra, login-flow, force-subject-identifier |
| Session must be of type JWTSessionContainer but got type: %T | error_code | error | oauth2, fosite, jwt, type-assertion, session |
| GetTokenClaims() must not be nil | error_code | error | oauth2, fosite, jwt, nil-claims, session |
| secret for signing HMAC-SHA512/256 is expected to be 32 byte | error_code | critical | oauth2, fosite, hmac, configuration, secret-length |
| unsupported private / public key pairs: %T, %T | exception | error | jwt, fosite, signing-keys, unsupported-key-type |
| unsupported private key type: %T | exception | error | jwt, fosite, signing-keys, unsupported-key-type |
| Could not convert key to RSA Public Key, got: %T | exception | error | jwt, jose, jwk, key-type, type-assertion |
ErrUnsupportedKeyAlgorithm %s | exception | error | jwk, crypto, unsupported-algorithm |
| panic during JSON Web Key generation for set %q: %v | exception | critical | panic, singleflight, jwk, concurrency |
| unsupported auth type %q | exception | error | configuration, oauth2, token-hook, http |
| cannot create XChaCha20-Poly1305 AEAD | exception | error | crypto, aead, chacha20, initialization |
| you have to set the remote endpoint, try --help for details | exception | error | cli, configuration, endpoint, missing-env-var |
| could not parse the endpoint URL "%s" | exception | error | cli, url, configuration, parsing |
| unable to print to stdout | exception | warning | io, cli, stdout, interactive |
| unable to read from stdin | exception | warning | io, cli, stdin, interactive |
| immutable configuration key "%s" was changed from "%v" to "% | exception | critical | configuration, hot-reload, immutable, secrets |
| unknown config file extension: %s | exception | error | |
| cookiex: cannot derive key | exception | error | |
| cookiex: cannot marshal cookie value | exception | error | |
| cookiex: cannot marshal envelope | exception | error | |
| cookiex: cannot create AEAD | exception | error | |
| cookiex: cannot generate nonce | exception | error | |
| cookiex: encoded cookie %q exceeds %d bytes | validation | error | |
| cookiex: cannot bridge legacy cookie | exception | error | |
| cookiex: cannot marshal cookie value | exception | error | |
| cookiex: cannot encode legacy cookie | exception | error | cookiex, legacy-securecookie, encoding |
| unable to read body | exception | error | http, request-body, io |
| read file: %s | exception | error | fetcher, filesystem, file-uri |
| base64decode: %s | exception | error | fetcher, base64, encoding |
ErrUnknownScheme unknown scheme in source: | exception | error | |
| new request: %s | exception | error | |
| expected http response status code 200 but got %d when fetch | http | error | |
| memory %v is too large | exception | error | |
ErrBcryptPasswordLengthReached passwords are limited to a maximum length of 72 characters | validation | error | bcrypt, password, validation, hashing |
| status is not yet ok: %s | exception | warning | http, healthcheck, retry, startup |
| key %s validation is failing | exception | error | network, ssrf, dns, validation |
| ip %s is not a permitted destination | exception | error | network, ssrf, ip-validation, security |
| failed to resolve %s | exception | error | |
| failed to apply empty landlock sandbox | exception | error | |
| failed to read from stdin | exception | error | |
| failed to evaluate jsonnet | exception | error | |
| failed to write json output | exception | error | go, io, broken-pipe, subprocess, stdout |
| newWorker: failed to create stdin pipe | exception | error | go, subprocess, file-descriptors, ulimit, pipe |
| newWorker: failed to create stdout pipe | exception | error | go, subprocess, file-descriptors, ulimit, pipe |
| newWorker: failed to create stderr pipe | exception | error | go, subprocess, file-descriptors, ulimit, pipe |
| newWorker: failed to start process | exception | critical | go, subprocess, exec, container, binary-not-found |
| newWorker: warm up failed | exception | critical | go, subprocess, sandbox, landlock, timeout |
| jsonnetsecure: marshal | exception | error | go, json, serialization, jsonnet |
| jsonnetsecure: acquire | exception | error | go, pool, concurrency, context-canceled, jsonnet |
| failed to run jsonnet within 1s: filename=%s | exception | error | timeout, jsonnet, context-deadline |
| jsonnetsecure: eval | exception | error | jsonnet, worker-process, wrapped-error |
| multiple types %+v are not supported for path: %s | exception | error | json-schema, types, codegen |
| detected circular dependency in schema path: %s | exception | error | json-schema, recursion, circular-reference |
| remote JSON pointers are not supported: %s | exception | error | json-pointer, validation, formatting |
| unsupported operation: %s | exception | error | json-patch, rfc6902, validation |
| error parsing patch operations: %v | exception | error | json-patch, rfc6902, malformed-request |
| patch includes denied path: %s | exception | error | json-patch, authorization, validation |
| expected status code 200 but got %d when requesting %s | exception | error | http, jwks, network |
| unable to find JSON Web Key with ID: %s | exception | error | jwks, jwt, key-rotation |
| a key ID must be specified when multiple JWK sets are config | exception | error | jwks, go, configuration, validation |
| jwksx: "%s" does not support arbitrary key length | exception | error | jwks, go, crypto, validation |
| jwksx: key size must be at least 2048 bit for algorithm "%s" | exception | error | jwks, go, crypto, rsa, security |
| jwksx: key size must be at least 256 bit for algorithm "%s" | exception | error | jwks, go, crypto, hmac, security |
| jwksx: key size must be at least 2038448 bit for algorithm " | validation | error | jwks, go, crypto, hmac, error-message-typo |
| jwksx: key size must be at least 512 bit for algorithm "%s" | exception | error | jwks, go, crypto, hmac, security |
| jwks: unable to generate key | exception | critical | jwks, go, crypto, entropy, ecdsa |
| jwksx: key size must be a multiple of 8 for algorithm "%s" b | exception | error | |
| jwksx: available algorithms are "%+v" but unknown algorithm | exception | error | |
| failed to parse URL | exception | error | |
| unable to read the file | exception | error | |
| unable to load remote file | exception | error | |
| unable to read the HTTP response body | exception | error | |
| unable to base64 decode the location | exception | error | |
| unsupported source `%s` | exception | error | url, scheme, unsupported |
| cannot marshal page token | exception | error | json, serialization, pagination |
| cannot create AEAD | exception | error | crypto, aead, encryption-key |
| cannot generate nonce | exception | critical | crypto, random, entropy |
| cannot open AEAD | exception | error | crypto, aead, authentication, tampering |
| could not query database version to verify dialect | exception | error | database, postgres, dialect, query |
| DSN scheme cockroach:// declares a CockroachDB database but | validation | error | database, cockroachdb, dialect, misconfiguration |
| DSN scheme yugabyte:// declares a YugabyteDB database but th | validation | error | database, yugabytedb, dialect, misconfiguration |
| DSN scheme postgres:// declares a PostgreSQL database but th | validation | error | database, dsn, cockroachdb, postgresql, config |
| DSN scheme postgres:// declares a PostgreSQL database but th | validation | error | database, dsn, yugabytedb, postgresql, config |
| %s | exception | error | migrations, database, dialect, file-naming |
| invalid database type %q, expected "all" because fizz is dat | validation | error | migrations, fizz, file-naming, database |
| invalid autocommit flag %q | validation | error | migrations, file-naming, autocommit, database |
| error processing %s | exception | error | migrations, database, sql, execution |
| error executing %s, sql: %s | exception | critical | migrations, database, sql, execution |
| unknown migration direction %q | validation | error | migrations, api-misuse, go |
| Found a migration file that does not match the file pattern: | validation | error | migrations, file-naming, database |
| unknown migration direction %q for %q | validation | error | migrations, file-naming, database |
| migration %s has no corresponding down migration | validation | error | migrations, go, validation, sql |
| could not parse template %s | exception | error | migrations, go, templates, sql |
| could not execute migration template %s | exception | error | migrations, go, templates, sql |
| no runner defined for %s | validation | error | migrations, go, configuration |
| failed to acquire sql.Conn for restore | exception | error | sqlite, go, database, context |
| driver %T does not support online restore | exception | error | sqlite, go, driver, backup |
| NewRestore failed | exception | error | sqlite, go, backup, filesystem |
| backup.Step failed | exception | error | sqlite, go, backup, io |
| backup.Finish failed | exception | error | sqlite, go, backup |
| problem checking for migration version %s | exception | error | migrations, sql, go, database |
| problem inserting migration version %s | exception | error | database, migration, go |
| problem inserting migration version %s. YOUR DATABASE MAY BE | exception | critical | database, migration, data-consistency, go |
| migration down: unable count existing migration | exception | error | database, migration, go |
| problem checking for legacy migration version %s | exception | error | database, migration, go |
| neither normal (%s) nor legacy migration (%s) exist | exception | error | database, migration, go |
| migration version %s does not exist | exception | error | database, migration, go |
| problem deleting migration version %s. YOUR DATABASE MAY BE | exception | critical | database, migration, data-consistency, go |
| problem deleting migration version %s | exception | error | database, migration, go |
| failed to run all SQL migrations: direction=%s timeout=%s | exception | error | database, migration, timeout, transaction |
| unable to execute statement: %s | exception | error | database, migration, sql, ddl |
| unable to find any migrations for dialect: %s | exception | error | database, migration, configuration, embed |
| problem with migration | exception | error | database, migration, sql, permissions |
| migrator: problem creating schema migrations | exception | error | database, migration, schema |
| invalid SQL identifier '%s' | validation | error | sql, validation, security, injection |
| cannot scan %T into region.Region | exception | error | database, scan, type-mismatch |
| cannot scan %#v into StringSliceJSONFormat | validation | error | database, scan, json, type-mismatch |
| expected JSON value to be an array but got type: %s | validation | error | database, json, scan, type-mismatch |
| cannot scan %T into JSONRawMessage | validation | error | json, database-scan, type-mismatch, sql-driver |
| failed to generate serial number: %s | exception | error | crypto, tls, random-generation, environment |
| failed to create certificate: %s | exception | error | tls, x509, crypto, invalid-key |
| failed to encode private key: %s | exception | error | tls, x509, crypto, parsing |
| the CA certificate does not have the client authentication e | validation | error | tls, x509, mtls, certificate-config |
| failed to generate private key: %s | exception | error | crypto, tls, rsa, environment |
| expected X-Forwarded-Proto header to be https but got: %s | http | error | http, tls, proxy, oryx |
| neither remote address nor any x-forwarded-for values match | exception | error | network, cidr, proxy, oryx |
| Expected request to be of type *Session, but got: %T | exception | error | go, type-mismatch, oauth2, device-flow |
server_error serialization failure | error_code | error | database, concurrency, oauth2, retry |
invalid_request existing user code signature | error_code | error | database, unique-constraint, oauth2, device-flow |
| unsupported key algorithm: %s | error_code | error | jose, jwk, crypto, validation |
| Expected request to be of type *Session, but got: %T | exception | error | go, type-mismatch, oauth2, refresh-token |
server_error serialization failure | error_code | error | database, concurrency, deadlock, oauth2, retry |
| err.Error() | http | warning | http, json, cli, oryx |
| Invalid action | http | error | http, validation, hydra |
| device_challenge is required | http | error | http, device-flow, validation, oauth2 |
| Failed to render template: %s | http | error | http, device-flow, template |
| Failed to parse form: %s | http | warning | http, form, device-flow, parsing |
| user_code is required | http | warning | http, device-flow, validation |
| No Hydra endpoint is configured | http | error | configuration, device-flow, hydra |
| Failed to encode request body: %s | http | error | http, json, handler |
| Failed to create request: %s | http | error | http, url, config |
| Failed to accept user code request: %s | http | error | network, http, hydra |
| Failed to read response: %s | http | error | network, http, io |
| Malformed response from the accept endpoint | http | error | json, hydra, api-contract |
server_error {"error":"server_error","error_description":"%s"} | http | error | oauth2, fosite, json |
| err.Error() | http | error | oauth2, fosite, json |
server_error {"error":"server_error","error_description":"%s"} | http | error | oauth2, fosite, authorize |
server_error ErrServerError.WithWrap(err).WithDebug(err.Error()).Error() | http | error | |
| err.Error() | http | error | |
server_error {"error":"server_error","error_description":"%s"} | http | error | |
| {"error": "%s"} | http | error | |
| err.Error() | http | error |