windmill-labs/windmill · error

oidc token request to {url} failed with status {status}: {bo

Error message

oidc token request to {url} failed with status {status}: {body}

What it means

get_id_token received an HTTP response from the OIDC token endpoint but with a non-200 status. The error message embeds the status code and the response body, which is typically the server's JSON or text error explaining why the token could not be issued (auth failure, unknown audience, disabled token endpoint).

Source

Thrown at backend/windmill-common/src/client.rs:98

            .as_ref()
            .unwrap_or(&HTTP_CLIENT)
            .post(&url)
            .header(
                reqwest::header::AUTHORIZATION,
                reqwest::header::HeaderValue::from_str(&format!("Bearer {}", self.token))?,
            )
            .send()
            .await
            .map_err(|e| {
                tracing::error!("Error requesting oidc token from {url}: {e:#?}");
                anyhow::anyhow!("Error requesting oidc token from {url}: {e:#?}")
            })?;

        match response.status().as_u16() {
            200u16 => Ok(response.text().await.context("reading oidc token body")?),
            status => {
                let body = response.text().await.unwrap_or_default();
                Err(anyhow::anyhow!(
                    "oidc token request to {url} failed with status {status}: {body}"
                ))
            }
        }
    }

    pub async fn get_resource_value<T: DeserializeOwned>(&self, path: &str) -> anyhow::Result<T> {
        let url = format!(
            "{}/api/w/{}/resources/get_value/{}",
            self.base_internal_url, self.workspace, path
        );
        make_basic_get_request(self, &url, None, Some("decoding resource value as json")).await
    }

    pub async fn get_variable_value(&self, path: &str) -> anyhow::Result<String> {
        let url = format!(
            "{}/api/w/{}/variables/get_value/{}",
            self.base_internal_url, self.workspace, path

View on GitHub (pinned to e474e8803c)

Solutions

  1. Read the body in the error message — it names the server-side reason (invalid token, unknown audience, etc.)
  2. Refresh the token used by the AuthedClient; re-authenticate the worker/agent
  3. Confirm the audience exists: check instance OIDC settings and that the audience was registered for this workspace
  4. Verify the workspace id in base URL matches an existing workspace
  5. If 5xx, check the upstream identity provider health and backend logs
Defensive patterns

Strategy: try-catch

Validate before calling

// Confirm audience is configured before requesting (the route is POST-only; check
// instance OIDC settings), and reject obviously malformed audiences:
if audience.trim().is_empty() || audience.contains(' ') { anyhow::bail!("invalid oidc audience: {audience:?}"); }

Try / catch

match client.get_id_token(aud).await {
    Err(e) if e.to_string().contains("failed with status") => {
        let msg = e.to_string();
        if msg.contains("401") || msg.contains("403") { /* rotate token and retry once */ }
        else if msg.contains("404") { /* audience/workspace not configured: fix config, don't retry */ }
        else if msg.contains("status 5") { /* upstream IdP issue: retry with backoff */ }
        Err(e)
    }
    other => other,
}

Prevention

When it happens

Trigger: POST /api/w/{ws}/oidc/token/{audience} returns 401/403 (the Bearer token is invalid, expired, or lacks permission), 404 (audience/token-issuer not configured for the workspace or wrong workspace id), 400 (invalid audience format), or 5xx from the upstream OIDC identity provider.

Common situations: Using a stale/revoked worker token, typo in the audience parameter, OIDC not configured in instance settings, hitting the wrong workspace in multi-workspace setups, upstream IdP (Keycloak/Auth0) outage returning 502/503.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/2bce456730da1259. Report an issue: GitHub.