weaviate/weaviate · error

failed to decode auth broker response

Error message

failed to decode auth broker response: %w

What it means

Thrown by fetchToken when the auth broker returned HTTP 200 but the response body could not be parsed as JSON into AuthBrokerToken. This indicates the endpoint did not return the expected {access_token, expiry, token_type} payload — typically because the URL points at an HTML page, a proxy login page, or an error body that still carries status 200.

Solutions

1. Curl the auth-broker endpoint with a valid identity token and inspect the raw response body
2. Ensure the endpoint URL points at the JSON token API, not a UI or redirect page
3. Check proxies/load balancers between Weaviate and the broker for body rewriting
4. Update Weaviate/broker if the token JSON schema changed

Example fix

// before: endpoint pointing at UI page
"authEndpoint": "https://auth-broker.example.com/"
// after: endpoint pointing at JSON token API
"authEndpoint": "https://auth-broker.example.com/v1/token"

// Go: assert the endpoint returns valid JSON before use
resp, _ := http.Get(brokerEndpoint)
body, _ := io.ReadAll(resp.Body)
var probe map[string]any
if json.Unmarshal(body, &probe) != nil {
    return errors.New("broker endpoint does not return JSON")
}

if err != nil {
    if strings.Contains(err.Error(), "failed to decode auth broker response") {
        // log response content-type/body shape; endpoint likely wrong or proxied
        return fmt.Errorf("broker returned non-JSON payload, check endpoint: %w", err)
    }
    return err
}

When it happens

Trigger: Token() → fetchTokenWithRetry → fetchToken, when json.NewDecoder(resp.Body).Decode fails: malformed JSON, empty body, HTML content, or a truncated response from the broker.

Common situations: Typo in auth-broker URL hitting a landing page; a corporate proxy or load balancer injecting an HTML error/interstitial page; broker service returning an empty body on 200; TLS-terminating middleware rewriting the response.

Understand the failure class

Background: "Invalid JSON response" and "Failed to parse response" errors: when an API answers 200 but the body isn't the JSON your library expected — this error's family across 28 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• auth broker returned non-200 status
• decode compare hashtree roots response
• decode response
• decode response
• failed to decode auth broker response

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/50b4cbad3f8e63e3. Report an issue: GitHub.

Appendix: source

Thrown at usecases/modulecomponents/gcpcommon/auth_broker.go:140

	if err != nil {
		return nil, fmt.Errorf("%w: %w", ErrRetryableAuthBroker, err)
	}
	defer func() {
		_, _ = io.Copy(io.Discard, resp.Body)
		resp.Body.Close()
	}()

	if resp.StatusCode >= 500 || resp.StatusCode == http.StatusTooManyRequests {
		return nil, fmt.Errorf("%w: auth broker returned status %d", ErrRetryableAuthBroker, resp.StatusCode)
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("auth broker returned non-200 status: %d", resp.StatusCode)
	}

	var bt AuthBrokerToken
	if err := json.NewDecoder(resp.Body).Decode(&bt); err != nil {
		return nil, fmt.Errorf("failed to decode auth broker response: %w", err)
	}

	if bt.AccessToken == "" || bt.Expiry.IsZero() {
		return nil, errors.New("auth broker response missing required fields (access_token, expiry)")
	}

	return &oauth2.Token{
		AccessToken: bt.AccessToken,
		TokenType:   bt.TokenType,
		Expiry:      bt.Expiry,
	}, nil
}

func (b *AuthBrokerTokenSource) getIdentityToken(ctx context.Context) (string, error) {
	if !metadata.OnGCE() {
		return "", errors.New("cluster is not running on GCE/GKE")
	}

View on GitHub (pinned to 75aa4b6d11)