redis/redis-py · error · InvalidTokenSchemaErr

Unexpected token schema. Following fields are missing: {miss

Error message

Unexpected token schema. Following fields are missing: {missing_fields}

What it means

Raised as InvalidTokenSchemaErr by JWToken._validate_token (redis/auth/token.py:130) when the decoded JWT is missing one or more REQUIRED_FIELDS (currently {"exp"}). The message lists exactly which fields are absent. The token may be valid JWT structurally but lacks the claims this library requires.

Source

Thrown at redis/auth/token.py:130

        )

    def try_get(self, key: str) -> str:
        return self._decoded.get(key)

    def get_value(self) -> str:
        return self._value

    def get_expires_at_ms(self) -> float:
        return float(self._decoded["exp"] * 1000)

    def get_received_at_ms(self) -> float:
        return datetime.now(timezone.utc).timestamp() * 1000

    def _validate_token(self):
        actual_fields = {x for x in self._decoded.keys()}

        if len(self.REQUIRED_FIELDS - actual_fields) != 0:
            raise InvalidTokenSchemaErr(self.REQUIRED_FIELDS - actual_fields)

View on GitHub (pinned to da03cdc7e8)

Solutions

1. Ensure the token includes the standard `exp` (Unix timestamp) claim.
2. If your IdP uses a different expiry claim, request a standards-compliant token or pre-process it to add exp.
3. For tokens that genuinely never expire, set exp to a far-future value or use SimpleToken with expires_at_ms=-1.

Example fix

# before
token_payload = {'sub': 'user1'}  # no exp -> InvalidTokenSchemaErr
# after
import time
token_payload = {'sub': 'user1', 'exp': int(time.time()) + 3600}

import time
required = {'exp'}
payload = decode_unverified(raw_jwt)
missing = required - set(payload)
if missing:
    raise ValueError(f'token missing fields: {missing}')

def has_required_claims(decoded: dict, required={'exp'}) -> bool:
    return required.issubset(decoded.keys())

from redis.auth.err import InvalidTokenSchemaErr
try:
    t = JWToken(raw_jwt)
except InvalidTokenSchemaErr as e:
    logger.error('rejecting malformed token: %s', e)
    raise

When it happens

Trigger: Passing a JWT to JWToken that has no `exp` claim; a token issued by an IdP that uses a custom expiry claim instead of standard `exp`; a malformed or truncated token that decodes to a near-empty payload.

Common situations: Custom/proprietary JWT format from a non-standard identity provider; test fixtures with hand-built tokens missing exp; token corruption in transit.

Related errors

• 'username' and 'password' cannot be passed along with 'crede
• The PyJWT library is required for {self.__class__.__name__}.
• Subcommand {subcommand_name} not found in command {command_n
• Command {command_name} not found in commands
• Invalid args in command: {command, *args}

AI-assisted analysis of redis/redis-py@da03cdc7e8 (2026-08-04). Data as JSON: /data/errors/dc8fa2d5792c9317.json. Report an issue: GitHub.