wavetermdev/waveterm · error

failed to generate job access token: %w

Error message

failed to generate job access token: %w

What it means

StartJob signs a WaveJwtClaims payload (MainServer=true, JobId) with wavejwt.Sign to mint the job access token; a signing failure is wrapped with this message. Signing depends on the server's JWT key material, so this usually means a key configuration/availability problem.

Source

Thrown at pkg/jobcontroller/jobcontroller.go:647

		return "", fmt.Errorf("error checking connection status: %w", err)
	}
	if !isConnected {
		return "", fmt.Errorf("connection %q is not connected", params.ConnName)
	}

	jobId := uuid.New().String()
	jobAuthToken, err := utilfn.RandomHexString(32)
	if err != nil {
		return "", fmt.Errorf("failed to generate job auth token: %w", err)
	}

	jobAccessClaims := &wavejwt.WaveJwtClaims{
		MainServer: true,
		JobId:      jobId,
	}
	jobAccessToken, err := wavejwt.Sign(jobAccessClaims)
	if err != nil {
		return "", fmt.Errorf("failed to generate job access token: %w", err)
	}

	job := &waveobj.Job{
		OID:              jobId,
		Connection:       params.ConnName,
		JobKind:          params.JobKind,
		Cmd:              params.Cmd,
		CmdArgs:          params.Args,
		CmdEnv:           params.Env,
		CmdTermSize:      *params.TermSize,
		JobAuthToken:     jobAuthToken,
		JobManagerStatus: JobManagerStatus_Init,
		AttachedBlockId:  params.BlockId,
		WaveVersion:      wavebase.WaveVersion,
		Meta:             make(waveobj.MetaMapType),
	}

	err = wstore.DBInsert(ctx, job)

View on GitHub (pinned to a4447c1563)

Solutions

1. Inspect the wrapped cause (%w) for the exact key/signing error.
2. Ensure the Wave JWT public/private key material exists and is loadable (restart the server to regenerate if corrupted).
3. Check file permissions on the key storage location so the server process can read it.

jobId, err := jobcontroller.StartJob(ctx, params)
if err != nil && strings.Contains(err.Error(), "failed to generate job access token") {
    return fmt.Errorf("JWT signing unavailable; check Wave key configuration: %w", err)
}

When it happens

Trigger: wavejwt.Sign returns an error — typically missing or unloaded signing key, key parse failure, or unsupported signing method due to misconfiguration.

Common situations: First-run key generation failed, JWT secret/key file missing or corrupted, key format changed between Wave Terminal versions.

Related errors

• error setting jwt public key: %v
• error making jwt token: %w
• No tab view found for the given webContents id
• cannot call ${methodName}: no web endpoint
• ai:model is required

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/f44683b842a9d5f7. Report an issue: GitHub.