ory/hydra · error

unable to decode JSON: %w

Error message

unable to decode JSON: %w

What it means

clientFromFlags in cmd/cmd_helper_client.go wraps a json.Decoder failure with "unable to decode JSON: %w". The CLI reads the OAuth2 client definition from --file (or stdin) and must parse it into hydra.OAuth2Client; this error means the input is not valid JSON or not shaped as an OAuth2 client object.

Source

Thrown at cmd/cmd_helper_client.go:32

	hydra "github.com/ory/hydra-client-go/v2"
	"github.com/ory/x/flagx"
)

func clientFromFlags(cmd *cobra.Command) (hydra.OAuth2Client, error) {
	if filename := flagx.MustGetString(cmd, flagFile); filename != "" {
		src := cmd.InOrStdin()
		if filename != "-" {
			f, err := os.Open(filename) // #nosec G304
			if err != nil {
				return hydra.OAuth2Client{}, fmt.Errorf("unable to open file %q: %w", filename, err)
			}
			defer f.Close() //nolint:errcheck
			src = f
		}
		client := hydra.OAuth2Client{}
		if err := json.NewDecoder(src).Decode(&client); err != nil {
			return hydra.OAuth2Client{}, fmt.Errorf("unable to decode JSON: %w", err)
		}
		return client, nil
	}

	return hydra.OAuth2Client{
		AccessTokenStrategy:               new(flagx.MustGetString(cmd, flagClientAccessTokenStrategy)),
		AllowedCorsOrigins:                flagx.MustGetStringSlice(cmd, flagClientAllowedCORSOrigin),
		Audience:                          flagx.MustGetStringSlice(cmd, flagClientAudience),
		BackchannelLogoutSessionRequired:  new(flagx.MustGetBool(cmd, flagClientBackChannelLogoutSessionRequired)),
		BackchannelLogoutUri:              new(flagx.MustGetString(cmd, flagClientBackchannelLogoutCallback)),
		ClientName:                        new(flagx.MustGetString(cmd, flagClientName)),
		ClientSecret:                      new(flagx.MustGetString(cmd, flagClientSecret)),
		ClientUri:                         new(flagx.MustGetString(cmd, flagClientClientURI)),
		Contacts:                          flagx.MustGetStringSlice(cmd, flagClientContact),
		FrontchannelLogoutSessionRequired: new(flagx.MustGetBool(cmd, flagClientFrontChannelLogoutSessionRequired)),
		FrontchannelLogoutUri:             new(flagx.MustGetString(cmd, flagClientFrontChannelLogoutCallback)),
		GrantTypes:                        flagx.MustGetStringSlice(cmd, flagClientGrantType),
		JwksUri:                           new(flagx.MustGetString(cmd, flagClientJWKSURI)),

View on GitHub (pinned to 4174065ffb)

Solutions

1. Validate the file with jq . <file> and fix JSON syntax
2. Ensure the content is a JSON object with client fields (e.g. {"client_name":...}), not a token or array
3. If piping via '-', check the producing command outputs valid JSON
4. Re-export the client from Hydra as JSON (hydra get client <id> --format json)

Example fix

// before (file content)
client_name: my-app
// after
{"client_name": "my-app"}

var c hydra.OAuth2Client
b, _ := os.ReadFile(p)
if err := json.Unmarshal(b, &c); err != nil {
    return fmt.Errorf("invalid client JSON: %w", err)
}

if err != nil {
    fmt.Fprintf(os.Stderr, "JSON decode failed: %v - validate with jq\n", err)
    os.Exit(1)
}

When it happens

Trigger: --file (or stdin via '-') containing malformed JSON, an exported JWT/id_token instead of a client object, YAML instead of JSON, trailing garbage, or a JSON array instead of an object.

Common situations: Pasting a client secret or token dump into the file, exporting from another tool in YAML, forgetting quotes around an empty file (0 bytes also fails), or curl output that was an HTML error page.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• could not parse the endpoint URL "%s"
• err.Error()
• header, body and signature must all be set
• command expects one argument which is the path to the output
• cookiex: payload must be a flat JSON object with string valu

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/b165f545b45a2ff2. Report an issue: GitHub.