quarkusio/quarkus · error · AuthenticationFailedException

Token issued to client %s is not active

Error message

Token issued to client %s is not active

What it means

After introspecting a token, Quarkus checks the 'active' boolean from the introspection response. This AuthenticationFailedException is thrown when the introspection endpoint reports the token as not active (revoked, expired, or not yet valid), even before other checks run.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java:416

            throw new AuthenticationFailedException(errorMessage, tokenMap(token, tokenType));
        }
        return client.introspectAccessToken(token).onItemOrFailure()
                .transform(new BiFunction<TokenIntrospection, Throwable, TokenIntrospection>() {

                    @Override
                    public TokenIntrospection apply(TokenIntrospection introspectionResult, Throwable t) {
                        if (t != null) {
                            throw new AuthenticationFailedException(t, tokenMap(token, tokenType));
                        }
                        Long introspectionExpiresIn = introspectionResult.getLong(OidcConstants.INTROSPECTION_TOKEN_EXP);
                        if (introspectionExpiresIn == null && expiresIn != null) {
                            // expires_in is relative to the current time
                            introspectionExpiresIn = now() + expiresIn;
                        }
                        if (!introspectionResult.isActive()) {
                            verifyTokenExpiry(token, tokenType, introspectionExpiresIn);
                            throw new AuthenticationFailedException(
                                    String.format("Token issued to client %s is not active", oidcConfig.clientId().get()),
                                    tokenMap(token, tokenType));
                        }
                        verifyTokenExpiry(token, tokenType, introspectionExpiresIn);
                        try {
                            verifyTokenAge(introspectionResult.getLong(OidcConstants.INTROSPECTION_TOKEN_IAT));
                        } catch (InvalidJwtException ex) {
                            throw new AuthenticationFailedException(ex, tokenMap(token, tokenType));
                        }

                        if (requiredClaims != null) {
                            for (Map.Entry<String, Set<String>> requiredClaim : requiredClaims.entrySet()) {
                                final String requiredClaimName = requiredClaim.getKey();
                                if (!introspectionResult.contains(requiredClaimName)) {
                                    LOG.debugf("Introspection claim %s is missing", requiredClaimName);
                                    throw new AuthenticationFailedException(tokenMap(token, tokenType));
                                }
                                final Set<String> requiredClaimValues = requiredClaim.getValue();

View on GitHub (pinned to e1c734241f)

Solutions

1. Obtain a fresh access token (refresh flow or re-authentication) — the presented token is invalid.
2. Clear the client-side token cache so revoked tokens are not reused.
3. Check why the token was deactivated (logout, revocation endpoint, session lifetime).
4. If the wrong token is being sent, configure the client to send the access token, not the ID token.

Example fix

// before: reuse cached token indefinitely
String token = cachedToken;
// after: refresh when expired/revoked
if (isExpiredOrInactive(token)) { token = refreshAccessToken(); }

TokenIntrospection ti = client.introspectAccessToken(token).await().indefinitely();
if (!ti.isActive()) {
    // refresh or re-authenticate before retrying the request
}

boolean isActiveToken(TokenIntrospection ti) {
    return ti != null && ti.isActive();
}

try {
    return authenticate(token);
} catch (AuthenticationFailedException e) {
    // token inactive: start refresh-token flow or force re-login
}

When it happens

Trigger: introspectToken's apply() receives TokenIntrospection with active=false — typically a revoked or expired access token presented as a Bearer token or code-flow token.

Common situations: User logged out / admin revoked the session but the client keeps sending the cached token; token expired server-side while the client cache hasn't refreshed; introspecting the wrong token type (e.g. ID token).

Related errors

• Token is opaque but the opaque token introspection is not al
• Token issued to client %s does not have a matching verificat
• Either 'jwks-path' or 'introspection-path' properties must b
• Introspection path is configured and 'verifyAccessTokenWithU
• Failed to generate key id

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ce0b0be2761daba3. Report an issue: GitHub.