serverless/serverless · error · Error

Gateway JWT authorizer requires discoveryUrl

Error message

Gateway JWT authorizer requires discoveryUrl

What it means

Error "Gateway JWT authorizer requires discoveryUrl" thrown in serverless/serverless.

Source

Thrown at packages/serverless/lib/plugins/aws/bedrock-agentcore/compilers/gateway.js:44

 *     WorkloadIdentityDetails
 */

import { getLogicalId, getGatewayResourceName } from '../utils/naming.js'
import { resolveRole } from '../utils/role.js'
import { transformCustomClaims } from '../utils/authorizer.js'

/**
 * Build authorizer configuration for the gateway
 */
export function buildGatewayAuthorizerConfiguration(authConfig) {
  if (!authConfig || !authConfig.jwt) {
    return null
  }

  const jwtConfig = authConfig.jwt

  if (!jwtConfig.discoveryUrl) {
    throw new Error('Gateway JWT authorizer requires discoveryUrl')
  }

  const transformedClaims = transformCustomClaims(jwtConfig.customClaims)

  return {
    CustomJWTAuthorizer: {
      DiscoveryUrl: jwtConfig.discoveryUrl,
      ...(jwtConfig.allowedAudience && {
        AllowedAudience: jwtConfig.allowedAudience,
      }),
      ...(jwtConfig.allowedClients && {
        AllowedClients: jwtConfig.allowedClients,
      }),
      ...(jwtConfig.allowedScopes && {
        AllowedScopes: jwtConfig.allowedScopes,
      }),
      ...(transformedClaims && {
        CustomClaims: transformedClaims,

View on GitHub (pinned to b9d7ea51c8)

Solutions

1. Add discoveryUrl to the gateway JWT authorizer configuration pointing at the OIDC discovery document.

When it happens

Trigger: Thrown at packages/serverless/lib/plugins/aws/bedrock-agentcore/compilers/gateway.js:44 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of serverless/serverless@b9d7ea51c8 (2026-08-13). Data as JSON: /api/errors/4beb93dca3c266b3. Report an issue: GitHub.