Incident case_e70b249ac513 · auth-api / production
SigningKeyUnavailable: No signing key matched kid f4c1a2e8 after JWKS refresh
- Environment
production- Service
auth-api- Package
2026.8.12- Commit
63432f1- SDK
0.4.0- Captured
Aug 29, 04:31 PM
- Occurrences
6- First seen
Aug 27, 09:59 AM- Last seen
Aug 29, 04:31 PM
Incident status is read-only here. In your own workspace this control writes the status back.
This is what ran before the throw.
Nodes on the rail sit in captured execution order. Arrows are causal claims, and each one carries where it came from.
5 of 5 shown
Drag to pan. Hold ⌘ or ctrl and scroll to zoom.Selected evidence node io-002.
Throw site
src/auth/jwks.ts:7171 throw new SigningKeyUnavailable(kid, keys.length);The local that mattered
candidateKids = missingmissingStack
3 app framesresolveSigningKeysrc/auth/jwks.ts:71
Locals
kidf4c1a2e8capturedcacheAgeSeconds214capturedrefreshAttemptedtruecapturedkeysAfterRefresh4capturedjwksDocument{"keys":[{"kty":"RSA","kid":"9b02c7d1","use":"sig","alg":"RS256","n":"0vx7agoebGcQSuu…truncatedThe JWKS body is 42.8 KB; the policy caps a single captured value at 8 KB.candidateKidsmissingmissingSDK reported shape[Array(Array(4))]The array nested past the policy depth limit, so the SDK recorded its shape instead of its contents.
Bound arguments
kidf4c1a2e8capturedissuerhttps://auth.acme-commerce.com/captured
verifyAccessTokensrc/auth/verify.ts:118
Locals
algorithmRS256capturedtokenIssuedAt2026-08-29T16:00:00.000ZcapturedclockSkewSeconds60capturedaccessToken[redacted]redactedBearer tokens are credentials and are removed by the deny list before storage.tokenHeadermissingmissingThe decoded header was derived from the redacted token, so nothing was retained for it.
Bound arguments
audienceacme-commerce-apicaptured
authenticatesrc/middleware/authenticate.ts:46
Locals
route/v1/orderscapturedauthSchemeBearercaptured
Bound arguments
2 node_modules frames
Object.jwtVerifynode_modules/jose/dist/node/cjs/jwt/verify.js:62
Locals
Bound arguments
Layer.handlenode_modules/express/lib/router/layer.js:95
Locals
Bound arguments
Raw I/O evidence
3 operations1GET auth:jwks:acmeredis://auth-cache.iad.internal:6379/0- Start
0 ms- Duration
0.7 ms
2GET /.well-known/jwks.jsonSDK marked related to throwhttps://auth.acme-commerce.com- Start
1.3 ms- Duration
96.4 ms
3A auth.acme-commerce.com10.4.0.2:53- Start
1.4 ms- Duration
11.2 ms
Request
- Method
GET- Route
/v1/orders- Status code
401- Request ID
req_5dd4e51c3f5728858f2f- Region
us-east-1
Headers
acceptapplication/jsoncaptureduser-agentacme-ios/6.2.0capturedauthorizationBearer [redacted]redactedCredential headers are removed by the deny list.cookie[redacted]redactedCredential headers are removed by the deny list.
No body was captured: the policy records bodies for mutating methods only.
Trace
- Trace ID
766835eb1456466b852d6ab71b65ca3d- Span ID
5fe4553e62e98d56- Parent span ID
842a1d407ee20054- Tracestate
acme=auth-api:1
Process and build
- Node version
v22.23.1- Host
auth-api-59d7c4b8f-qz6vt- Package version
2026.8.12- Commit SHA
63432f18c1b7ea7e5b0ab6a14dd9f5f451662237- Reported environment
production- Release
[email protected]- SDK version
0.4.0- Memory
rss 221 MB, heap 84 MB- Event loop lag
3 ms
Completeness
requesttruncatedTwo credential headers were removed by the deny list.
localstruncatedOne value exceeded the 8 KB cap and one nested past the depth limit.
bound argscaptured
IOcaptured
Measured coverage
Measured from the reconstructed evidence, not from what the SDK reported about itself.
- request
- partialTwo credential headers were removed before storage.
- locals
- partialOne value was capped at 8 KB and one was reduced to a shape summary.
- io
- exactThree operations recorded, none dropped.
- source
- exactThe release artifact digest matched the deployed build.
Specific gaps
appFrames[0].locals.jwksDocumentThe value is 42.8 KB and the policy caps a single captured value at 8 KB. The first 8 KB is retained.appFrames[0].locals.candidateKidsThe array nested past the policy depth limit. The SDK recorded its shape and no contents.appFrames[1].locals.accessTokenBearer tokens are credentials and are removed by the deny list before storage.request.headers.authorizationCredential headers are removed by the deny list before storage.
Agent access
https://mcp.errorcore.dev/sse- Incident ID
inc_e70b249ac513- Occurrence ID
occ_5fe8593ca89fbbac7235f943f3a7a3a8701c32d75eca455f8bcf66fb1d3b7e35
MCP instruction
MCP server: https://mcp.errorcore.dev/sse
Tool: get_failure_context
Arguments: {"occurrence_id":"occ_5fe8593ca89fbbac7235f943f3a7a3a8701c32d75eca455f8bcf66fb1d3b7e35"}
Task: Investigate this failure using only the exposed, scrubbed runtime evidence.