ory/hydra · error

failed to decode JSON Web Key Set

Error message

failed to decode JSON Web Key Set

What it means

In OnlyPublicSDKKeys the encoded key set is decoded back into []jose.JSONWebKey (interim). This error wraps a json.Decoder failure on that round-trip — meaning the JSON produced by the earlier encode step could not be parsed into jose.JSONWebKey, indicating corrupt or structurally incompatible JSON.

Source

Thrown at cmd/jwk_sdk.go:27

	jose "github.com/go-jose/go-jose/v3"
	"github.com/pkg/errors"

	hydra "github.com/ory/hydra-client-go/v2"
)

// OnlyPublicSDKKeys strips the private parts from a key set so that it is safe
// to print.
func OnlyPublicSDKKeys(in []hydra.JsonWebKey) (out []hydra.JsonWebKey, _ error) {
	var interim []jose.JSONWebKey
	var b bytes.Buffer

	if err := json.NewEncoder(&b).Encode(&in); err != nil {
		return nil, errors.Wrap(err, "failed to encode JSON Web Key Set")
	}

	if err := json.NewDecoder(&b).Decode(&interim); err != nil {
		return nil, errors.Wrap(err, "failed to decode JSON Web Key Set")
	}

	for i, key := range interim {
		interim[i] = key.Public()
	}

	b.Reset()
	if err := json.NewEncoder(&b).Encode(&interim); err != nil {
		return nil, errors.Wrap(err, "failed to encode JSON Web Key Set")
	}

	var keys []hydra.JsonWebKey
	if err := json.NewDecoder(&b).Decode(&keys); err != nil {
		return nil, errors.Wrap(err, "failed to decode JSON Web Key Set")
	}

	return keys, nil
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Inspect the wrapped decode error's Offset/field to see which JSON shape was rejected.
2. Ensure hydra.JsonWebKey and jose.JSONWebKey versions are aligned (go mod tidy / update ory/hydra and go-jose to compatible versions).
3. Log the intermediate JSON (b.String()) to diagnose the mismatch.

Example fix

// debug
if err := json.NewDecoder(&b).Decode(&interim); err != nil {
    log.Printf("jwk json: %s", b.String())
    return nil, err
}

if b, err := json.Marshal(in); err != nil || !json.Valid(b) {
    return fmt.Errorf("key set did not round-trip to valid JSON")
}

out, err := OnlyPublicSDKKeys(keys)
if err != nil {
    log.Printf("jwk conversion error: %+v", err) // wrapped decode error shows JSON offset
    return nil, err
}

When it happens

Trigger: The bytes.Buffer round-trip decoding fails: only reachable if the encode step produced JSON that Decode rejects, which for valid JsonWebKey input effectively cannot occur; it surfaces if a custom JsonWebKey marshals to a non-object JSON value.

Common situations: Practically only seen with corrupted or adversarially-crafted JsonWebKey values; also possible if a vendored version mismatch makes hydra.JsonWebKey marshal differently than jose.JSONWebKey expects.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to encode JSON Web Key Set
• cookiex: payload must be a flat JSON object with string valu
• invalid JWK key
• priv/pub JWK key mismatch
• unable to decode JSON: %w

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/7a4073b28bfcafe3. Report an issue: GitHub.