What causes "id_token validation failed: %w" in pocketbase/pocketbase?

Retry the sign-in once — transient JWKS fetch failures and post-rotation races self-heal.

id_token validation failed: %w

Error message

id_token validation failed: %w

What it means

Apple Sign In provider fails to validate the id_token signature. After exchanging the code with Apple, the provider parses the JWT claims and then verifies the token signature against Apple's JWKS endpoint (https://appleid.apple.com/auth/keys) using jwk.ValidateTokenSignature; any failure there is wrapped in this error.

Source

Thrown at tools/auth/apple.go:145

		jwt.WithIssuedAt(),
		jwt.WithLeeway(idTokenLeeway),
		jwt.WithIssuer("https://appleid.apple.com"),
		jwt.WithAudience(p.clientId),
	)
	err = jwtValidator.Validate(claims)
	if err != nil {
		return nil, err
	}

	// validate id_token signature
	//
	// note: this step could be technically considered optional because we trust
	// the token which is a result of direct TLS communication with the provider
	// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)
	// ---
	err = jwk.ValidateTokenSignature(p.ctx, idToken, p.jwksURL)
	if err != nil {
		return nil, fmt.Errorf("id_token validation failed: %w", err)
	}

	return claims, nil
}

View on GitHub (pinned to 5d217ddb50)

Solutions

Retry the sign-in once — transient JWKS fetch failures and post-rotation races self-heal.
Verify the server can reach https://appleid.apple.com/auth/keys (curl) and that TLS/DNS work.
Check server clock (NTP sync); large skew can break downstream JWT validation.
Inspect the wrapped error: 'missing JWK with kid' means key rotation race — retry; a network error means egress blocking.

Defensive patterns

Strategy: retry

Try / catch

user, err := provider.FetchAuthUser(token)
if err != nil {
	if strings.Contains(err.Error(), "id_token validation failed") {
		// key rotation race or transient JWKS failure: single retry
		user, err = provider.FetchAuthUser(token)
	}
	if err != nil {
		return redirectWithError("apple_signin_failed")
	}
}

Prevention

Monitor reachability of https://appleid.apple.com/auth/keys from your servers.
Keep server clocks NTP-synced.
Log the wrapped cause to distinguish rotation races from outages.

When it happens

Trigger: Apple rotating its signing keys so the cached/announced kid no longer resolves; JWKS endpoint temporarily returning an error page; a network/TLS failure fetching appleid.apple.com/auth/keys; clock skew or an actually-tampered token.

Common situations: Intermittent sign-in failures on Apple auth right after Apple rotates keys; corporate proxies or firewalls blocking the JWKS URL; misconfigured system time; rare regions where appleid.apple.com is throttled.

Related errors

AI-assisted analysis of pocketbase/pocketbase@5d217ddb50 (2026-08-15). Data as JSON: /api/errors/01a557c57161a1ae. Report an issue: GitHub.