wavetermdev/waveterm · error

error getting jwt public key: %v

Error message

error getting jwt public key: %v

What it means

Returned by serverRunRouter when the GetJwtPublicKeyCommand RPC fails after the RPC client is set up. The server needs the JWT public key to validate tokens; failing to fetch it aborts startup. The wrapped error carries the RPC-level cause.

Source

Thrown at cmd/wsh/cmd/wshcmd-connserver.go:251

	}()
	router.RegisterUpstream(termProxy)

	sockName := getRemoteDomainSocketName()

	// setup the connserver rpc client first
	client, bareRouteId, err := setupConnServerRpcClientWithRouter(router, sockName)
	if err != nil {
		return fmt.Errorf("error setting up connserver rpc client: %v", err)
	}
	wshfs.RpcClient = client
	wshfs.RpcClientRouteId = bareRouteId

	log.Printf("trying to get JWT public key")

	// fetch and set JWT public key
	jwtPublicKeyB64, err := wshclient.GetJwtPublicKeyCommand(client, nil)
	if err != nil {
		return fmt.Errorf("error getting jwt public key: %v", err)
	}
	jwtPublicKeyBytes, err := base64.StdEncoding.DecodeString(jwtPublicKeyB64)
	if err != nil {
		return fmt.Errorf("error decoding jwt public key: %v", err)
	}
	err = wavejwt.SetPublicKey(jwtPublicKeyBytes)
	if err != nil {
		return fmt.Errorf("error setting jwt public key: %v", err)
	}

	log.Printf("got JWT public key")

	// now set up the domain socket
	unixListener, err := MakeRemoteUnixListener()
	if err != nil {
		return fmt.Errorf("cannot create unix listener: %v", err)
	}
	log.Printf("unix listener started")

View on GitHub (pinned to a4447c1563)

Solutions

1. Retry the server startup — a concurrent connserver restart often causes transient failures
2. Check the connserver logs to see why it refused or failed to serve the JWT public key
3. Verify client and server wsh versions match so the GetJwtPublicKey RPC exists on both
4. Confirm the RPC connection is still alive before the call (the client was just set up — a quick drop points at the connserver)

Example fix

// before
jwtPublicKeyB64, err := wshclient.GetJwtPublicKeyCommand(client, nil)
if err != nil {
    return fmt.Errorf("error getting jwt public key: %v", err)
}
// after
var jwtPublicKeyB64 string
var err error
for i := 0; i < 3; i++ {
    jwtPublicKeyB64, err = wshclient.GetJwtPublicKeyCommand(client, &wshrpc.RpcOpts{Timeout: 10000})
    if err == nil {
        break
    }
    time.Sleep(500 * time.Millisecond)
}
if err != nil {
    return fmt.Errorf("error getting jwt public key: %v", err)
}

if client == nil || bareRouteId == "" {
    return fmt.Errorf("rpc client not ready; cannot fetch jwt public key")
}

var jwtPublicKeyB64 string
var err error
for i := 0; i < 3; i++ {
    if jwtPublicKeyB64, err = wshclient.GetJwtPublicKeyCommand(client, &wshrpc.RpcOpts{Timeout: 10000}); err == nil {
        break
    }
    time.Sleep(500 * time.Millisecond)
}
if err != nil {
    return fmt.Errorf("error getting jwt public key: %v", err)
}

When it happens

Trigger: The GetJwtPublicKeyCommand call errors: the connserver dropped the route right after connect, the RPC times out, or the server refuses to serve the key (auth/version mismatch).

Common situations: Connserver restarting concurrently with router startup, network/socket disruption mid-handshake, client-server version mismatch removing or renaming the RPC method, permission denial on the server side.

Related errors

• error authenticating with upstream: %v
• error authenticating rpc connection: %v
• error setting up connserver rpc client: %v
• error decoding jwt public key: %v
• failed to authenticate to server: %w

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/a51d545c70225726. Report an issue: GitHub.