# JWT validation failure: error getting the keys from the key func: could not get well known endpoints from url

**URL:** <https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [September 15, 2023, 5:09pm UTC](https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366 "2023-09-15T17:09:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbonnet](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mbonnet](https://community.auth0.com/u/mbonnet)\
**Post date:** [September 15, 2023, 5:09pm UTC](https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366/1 "2023-09-15T17:09:09Z")

</div>

I have a Go backend that uses github user zett-8’s [go-clean-echo](https://github.com/zett-8/go-clean-echo/) as a template. Their template uses a middleware explicitly using auth0. I have a React frontend that properly uses auth0 for login and for getting JWT tokens to interact with the backend, which uses an auth0 API in the jwt middleware.

The middleware is as follows:

```auto
package middlewares

import (
	"fmt"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	"tlmgateway/configs"

	"github.com/auth0/go-jwt-middleware/v2/jwks"
	"github.com/auth0/go-jwt-middleware/v2/validator"
	"github.com/labstack/echo/v4"
	// "github.com/zett-8/go-clean-echo/configs"
)

func JwtMiddleware() (echo.MiddlewareFunc, error) {
	// auth0Config := configs.Auth0Config

	auth0Config := configs.Auth0ConfigType{
		Domain: os.Getenv("AUTH0_DOMAIN"), // my tenant domain
		ClientID: os.Getenv("AUTH0_CLIENTID"), // client ID for my single-page application
		Audience: []string{os.Getenv("AUTH0_AUDIENCE")}, // identifier URL for my custom API
		Issuer: os.Getenv("AUTH0_DOMAIN"), // my tenant domain
		SignatureAlgorithm: validator.RS256,
		CacheDuration: 15 * time.Minute,
	}

	issuerURL, err := url.Parse(auth0Config.Issuer)
	if err != nil {
		return nil, err
	}

	provider := jwks.NewCachingProvider(issuerURL, auth0Config.CacheDuration)

	jwtValidator, err := validator.New(
		provider.KeyFunc,
		auth0Config.SignatureAlgorithm,
		issuerURL.String(),
		auth0Config.Audience,
	)
	if err != nil {
		return nil, err
	}

	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {

			authorization := c.Request().Header.Get("Authorization")
			if authorization == "" {
				return echo.NewHTTPError(http.StatusUnauthorized, "No Authorization Header")
			}

			if !strings.HasPrefix(authorization, "Bearer ") {
				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid Authorization Header")
			}

			token := strings.TrimPrefix(authorization, "Bearer ")

			fmt.Printf("\nToken: %s\n\n", token)

			claims, err := jwtValidator.ValidateToken(c.Request().Context(), token)
			if err != nil {
				fmt.Printf("\n%s\n\n", err)
				// logger.Error("Invalid Token: ", zap.Error(err))
				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid Token")
			}

			c.Set("claims", claims.(*validator.ValidatedClaims))

			return next(c)
		}
	}, nil
}

```

the call to jwtValidator.ValidateToken causes an error, which is the following:

`failed to deserialize token claims: error getting the keys from the key func: could not get well known endpoints from url <my_domain>/.well-known/openid-configuration: Get "<my_domain>/.well-known/openid-configuration": unsupported protocol scheme ""`

The token generated by `getAccessTokenSilently` on my frontend is valid, as confirmed by [https://jwt.io/](https://jwt.io/)

While I have been able to find vanishingly little information on this particular error (essentially, one forum post here where the user said they just gave up), I have the feeling it has something to do with the configuration of the tenant/domain.

What might be the root cause(s) of this error, and how might I address them?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 15, 2023, 9:28pm UTC](https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366/2 "2023-09-15T21:28:44Z")

</div>

Hello @mbonnet welcome to the community!

Thanks for sharing your code and a detailed description of the issue you’re seeing.

> [@mbonnet](#):
>
> While I have been able to find vanishingly little information on this particular error (essentially, one forum post here where the user said they just gave up), I have the feeling it has something to do with the configuration of the tenant/domain.

I tend to agree!

> [@mbonnet](#):
>
> What might be the root cause(s) of this error, and how might I address them?

What does your your `AUTH0_DOMAIN` look like? Feel free to redact the actual name if you want to share here. I know in our [sample app](https://github.com/auth0-samples/auth0-golang-api-samples/blob/4138c0c58bef7a526f6f59be98b6d4c263a37bc9/01-Authorization-RS256/middleware/jwt.go#L42) we add the scheme (`https`) and a forward slash (`/`) to the issuer url:

```auto
issuerURL, err := url.Parse("https://" + os.Getenv("AUTH0_DOMAIN") + "/")

```

If that isn’t the issue, then I definitely recommend pulling down the sample itself and configuring to your environment - I would be interested to know if you receive any error there. If not, it could be helpful to compare against your code.

Keep us posted!

---

<div class="post-metadata">

**Author:** ![mbonnet](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mbonnet](https://community.auth0.com/u/mbonnet)\
**Post date:** [September 18, 2023, 5:38pm UTC](https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366/3 "2023-09-18T17:38:35Z")

</div>

The issue was indeed the lack of the preceding scheme and following forward slash. Thank you so much!

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 19, 2023, 3:09pm UTC](https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366/4 "2023-09-19T15:09:03Z")

</div>

No problem, happy to help! Glad you were able to get this sorted 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 3, 2023, 3:09pm UTC](https://community.auth0.com/t/jwt-validation-failure-error-getting-the-keys-from-the-key-func-could-not-get-well-known-endpoints-from-url/116366/5 "2023-10-03T15:09:49Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.