ory/hydra · error

cookiex: cannot derive key

Error message

cookiex: cannot derive key

What it means

Returned by cookiex.New when HKDF key derivation over one of the provided secrets fails (wrapped with "cookiex: cannot derive key"). Derivation with SHA-256 effectively only fails if the system PRNG/IO is broken; per-secret input is arbitrary bytes, so this is an environmental or crypto-library failure, not bad user input.

Source

Thrown at oryx/cookiex/cookiex.go:104

	}
	if len(secrets) == 0 {
		return nil, errors.New("cookiex: at least one secret is required")
	}
	cfg := config{maxAge: defaultMaxAge}
	for _, opt := range opts {
		opt(&cfg)
	}
	if cfg.maxAge < 0 {
		return nil, errors.New("cookiex: max age must not be negative")
	}
	if cfg.legacyEncode && len(cfg.legacyKeyPairs) == 0 {
		return nil, errors.New("cookiex: legacy encode requires legacy key pairs")
	}
	keys := make([][32]byte, len(secrets))
	for i, secret := range secrets {
		key, err := hkdf.Key(sha256.New, secret, nil, kdfInfo, 32)
		if err != nil {
			return nil, errors.Wrap(err, "cookiex: cannot derive key")
		}
		keys[i] = [32]byte(key)
	}
	return &Codec[T]{
		purpose: purpose,
		keys:    keys,
		maxAge:  cfg.maxAge,
		legacy:  newLegacyState(cfg, cfg.maxAge),
		now:     time.Now,
	}, nil
}

// envelope wraps the JSON payload with the seal time so decoding can enforce
// the max age.
type envelope struct {
	IssuedAt int64           `json:"iat"`
	Values   json.RawMessage `json:"v"`
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Inspect the wrapped underlying error for the actual HKDF failure cause
2. Verify the secrets slice contains usable byte strings and is not corrupted
3. Treat failure as fatal at startup; cookie keys cannot be provisioned without derivation

When it happens

Trigger: Thrown at oryx/cookiex/cookiex.go:104 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/4e51a7d56fb04e5c. Report an issue: GitHub.