ruvnet/RuView · error · HTTPException

JWT authentication is not configured. Configure JWT_SECRET a

Error message

JWT authentication is not configured. Configure JWT_SECRET and JWT_ALGORITHM environment variables, or integrate an external identity provider. See docs/authentication.md for setup instructions.

What it means

The production branch of get_current_user: outside development mode, if JWT validation is not configured (JWT_SECRET/JWT_ALGORITHM missing), every request presenting credentials gets 401 with instructions to configure JWT or integrate an external identity provider. This is a hard deployment configuration failure, not a per-token problem.

Source

Thrown at archive/v1/src/api/dependencies.py:101

    if settings.is_development:
        logger.warning(
            "Authentication credentials provided in development mode but JWT "
            "validation is not configured. Set up JWT authentication via "
            "environment variables (JWT_SECRET, JWT_ALGORITHM) or disable "
            "authentication. Rejecting request."
        )
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail=(
                "JWT authentication is not configured. In development mode, either "
                "disable authentication (enable_authentication=False) or configure "
                "JWT validation. Returning mock users is not permitted in any environment."
            ),
            headers={"WWW-Authenticate": "Bearer"},
        )

    # In production, implement proper JWT validation
    raise HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail=(
            "JWT authentication is not configured. Configure JWT_SECRET and "
            "JWT_ALGORITHM environment variables, or integrate an external "
            "identity provider. See docs/authentication.md for setup instructions."
        ),
        headers={"WWW-Authenticate": "Bearer"},
    )


async def get_current_active_user(
    current_user: Optional[Dict[str, Any]] = Depends(get_current_user)
) -> Dict[str, Any]:
    """Get current active user (required authentication)."""
    if not current_user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Authentication required",

View on GitHub (pinned to 4685618388)

Solutions

1. Set JWT_SECRET (and JWT_ALGORITHM, e.g. HS256) in the server environment and restart the process
2. Add a startup assertion that fails fast when authentication is enabled but JWT is unconfigured, so misconfiguration surfaces at boot instead of per-request
3. If using an external identity provider, integrate its key material/JWKS as the validation source
4. Confirm every step in docs/authentication.md is complete for the deployment target

Example fix

# before
# container started without secrets -> every authed request 401

# after
docker run -e JWT_SECRET=$JWT_SECRET -e JWT_ALGORITHM=HS256 ... ruview-api

# Deployment preflight: never start prod without JWT config
import os
missing = [k for k in ('JWT_SECRET', 'JWT_ALGORITHM') if not os.environ.get(k)]
if missing:
    raise SystemExit(f'Refusing to start: missing {missing}. See docs/authentication.md')

When it happens

Trigger: Production/staging deployment where JWT_SECRET is missing from the process environment; container or pod started without the secret mounted; settings loaded from a .env file that was not copied into the image; any authenticated call at all once the config is missing.

Common situations: Secrets not wired into Docker/Kubernetes manifests; migrating to a new host without the env files; CI environment differing from prod; is_development accidentally true in dev masked the gap until deploy.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• JWT authentication is not configured. In development mode, e
• Invalid authentication credentials
• Token has expired
• Invalid token
• Authentication required

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/af8e87b6d5be04f8. Report an issue: GitHub.