Has anyone faced an issue with JWT access requiring a secret or public key, even though the keys are present in Docker

[aravindhfinix]

🛠 JWT Setup Debug Notes

I generated the keys using yarn generate:keys.
I created a .env file based on example.env.
I started Docker.
-docker-compose up -d

seeded the data
-docker-compose exec apis yarn migrate:seed

Initially, I faced errors in the Mongo and Redis containers.

🔧 I fixed this by updating the DB connection URLs in the .env file — specifically, I changed the hostnames to match the container names.

this has to be changed from host to container name mongo

mongo-init:
image: mongo:latest
restart: 'no'
depends_on:
mongo:
condition: service_healthy
networks:
- app-network
command: >
bash -c "
echo 'Waiting for MongoDB instance to be ready...' &&
mongosh --host mongo:27017 --eval '
config = {
"_id": "rs0",
"members": [
{ "_id": 0, "host": "mongo:27017", "priority": 1 }
]
};
rs.initiate(config);
rs.status();' &&
echo 'Single-node replica set initialized successfully. Container will exit now.'
"
deploy:
restart_policy:
condition: none

After that, Mongo and Redis connected successfully, and Docker was running fine.

However, when hitting an API, the JWKS server could not be reached.

🔧 I fixed that by updating the AUTH_JWT_JWKS_URI to:

http://jwks-server/.well-known/jwks.json

That resolved the JWKS connection error, but then I encountered this JWT error:

Error: secret or public key must be provided

This prevented JWT authentication from working.

✅ Summary of Fixes Done

✔️ Keys generated properly
✔️ .env configured correctly
✔️ MongoDB & Redis containers fixed with proper hostnames
✔️ JWKS server hostname corrected
❌ Still stuck on JWT secret/public key not being recognized

[Gzerox]

Hey @aravindhfinix , could you provide your docker-compose.yaml ?

[aravindhfinix]

name: ack-nestjs-boilerplate

services:
    # Main API service
    apis:
        build:
            context: .
        hostname: apis
        ports:
            - 3000:3000
        volumes:
            - ./src/:/app/src/
            - .env/:/app/.env
            - ./keys/access-token.pem:/app/keys/access-token.pem
            - ./keys/access-token.pub:/app/keys/access-token.pub
            - ./keys/refresh-token.pem:/app/keys/refresh-token.pem
            - ./keys/refresh-token.pub:/app/keys/refresh-token.pub
        restart: on-failure
        networks:
            - app-network
        depends_on:
            - redis
            - mongo
            - jwks-server
        deploy:
            resources:
                limits:
                    cpus: '1'
                    memory: 1G
                reservations:
                    cpus: '0.5'
                    memory: 512M

    # JWKS Server for token validation
    jwks-server:
        image: nginx:alpine
        hostname: jwks-server
        ports:
            - '3011:80'
        volumes:
            - ./keys/jwks.json:/usr/share/nginx/html/.well-known/jwks.json
            - ./ci/jwks-server/jwks.conf:/etc/nginx/conf.d/default.conf
        networks:
            - app-network
        deploy:
            resources:
                limits:
                    cpus: '0.5'
                    memory: 128M
        healthcheck:
            test:
                [
                    'CMD',
                    'wget',
                    '-qO-',
                    'http://localhost:80/.well-known/jwks.json',
                ]
            interval: 30s
            timeout: 10s
            retries: 3
            start_period: 5s

    # Redis for caching and queues
    redis:
        image: redis:latest
        hostname: redis
        ports:
            - '6379:6379'
        volumes:
            - redis_data:/data
        networks:
            - app-network
        deploy:
            resources:
                limits:
                    cpus: '0.5'
                    memory: 256M
        healthcheck:
            test: ['CMD', 'redis-cli', 'ping']
            interval: 10s
            timeout: 30s
            retries: 5

    # Bull dashboard for queue monitoring
    redis-bullboard:
        image: deadly0/bull-board:3.2.6
        hostname: redis-bullboard
        ports:
            - 3010:3000
        networks:
            - app-network
        environment:
            - REDIS_HOST=redis
            - REDIS_PORT=6379
            - BULL_PREFIX=bull
            - USER_LOGIN=admin
            - USER_PASSWORD=admin123
        depends_on:
            - redis
        deploy:
            resources:
                limits:
                    cpus: '0.3'
                    memory: 128M

    # MongoDB Replica Set - Primary Node
    mongo:
        image: mongo:latest
        hostname: mongo
        ports:
            - '27017:27017'
        networks:
            - app-network
        volumes:
            - mongo_data:/data/db
        command: mongod --bind_ip_all --replSet rs0 --port 27017
        extra_hosts:
            - 'host.docker.internal:host-gateway'
        deploy:
            resources:
                limits:
                    cpus: '1'
                    memory: 1G
                reservations:
                    memory: 512M
        healthcheck:
            test: mongosh --eval "db.adminCommand('ping')" --quiet
            interval: 10s
            timeout: 5s
            retries: 5
            start_period: 20s

    # MongoDB Replica Set Initialization service
    mongo-init:
        image: mongo:latest
        restart: 'no'
        depends_on:
            mongo:
                condition: service_healthy
        networks:
            - app-network
        command: >
            bash -c "
            echo 'Waiting for MongoDB instance to be ready...' &&
            mongosh --host mongo:27017 --eval '
            config = {
                \"_id\": \"rs0\",
                \"members\": [
                    { \"_id\": 0, \"host\": \"mongo:27017\", \"priority\": 1 }
                ]
            };
            rs.initiate(config);
            rs.status();' &&
            echo 'Single-node replica set initialized successfully. Container will exit now.'
            "
        deploy:
            restart_policy:
                condition: none

volumes:
    mongo_data:
    redis_data:

networks:
    app-network:
        driver: bridge

@Gzerox

[Gzerox]

Thanks @aravindhfinix ,
Which service is returning the error you are mentioning ?

Error: secret or public key must be provided

What do you .env var look like ?

AUTH_JWT_ACCESS_TOKEN_PRIVATE_KEY_PATH=/app/keys/access-token.pem
AUTH_JWT_ACCESS_TOKEN_PUBLIC_KEY_PATH=/app/keys/access-token.pub

Are you able to hit the login endpoint succesfully ? (and getting back http 200 with accessToken)

[aravindhfinix]

Iam using this path

AUTH_JWT_ACCESS_TOKEN_PRIVATE_KEY_PATH=keys/access-token.pem
AUTH_JWT_ACCESS_TOKEN_PUBLIC_KEY_PATH=keys/access-token.pub

if i use this path u have given

AUTH_JWT_ACCESS_TOKEN_PRIVATE_KEY_PATH=/app/keys/access-token.pem
AUTH_JWT_ACCESS_TOKEN_PUBLIC_KEY_PATH=/app/keys/access-token.pub

facing this issue

Error: ENOENT: no such file or directory, open '/app/app/keys/access-token.pem'

And yes i was able to login successfully and get the access token and refresh token ,but i face the public or secret key issue when verifing the given access token in header for other endpoints

apis-1 | AuthJwtAccessGuard Error: null JsonWebTokenError: secret or public key must be provided

curl -X 'POST' \
  'http://localhost:3000/api/v1/admin/robot/create' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCIsImtpZCI6ImFjY2Vzc19rZXlfMDAxIn0.eyJ1c2VyIjoiZDJiMTc4NzEtOTgxNy00Nzk2LWI5MzEtNWQ5OTkxZWZkOWZmIiwidHlwZSI6IkFETUlOIiwicm9sZSI6IjIxOGQ4MjM2LWQ0NmQtNGY5MC04ZmJkLTY4ODA1ZGVmZjk5MCIsImVtYWlsIjoiam9obi5kb2UzQG5ldXJhbHBpbG90LmFpIiwic2Vzc2lvbiI6IjBjOWUxMWNmLTI5MjYtNDJmMi05YzBlLTUzYzg5NTI3OGU5NSIsImxvZ2luRGF0ZSI6IjIwMjUtMDYtMjdUMDU6MTQ6NDQuMzgxWiIsImxvZ2luRnJvbSI6IkNSRURFTlRJQUwiLCJpYXQiOjE3NTEwMDEyODQsImV4cCI6MTc1MTAwNDg4NCwiYXVkIjoiTmVzdEpzIiwiaXNzIjoiaHR0cHM6Ly9leGFtcGxlLmlkIiwic3ViIjoiZDJiMTc4NzEtOTgxNy00Nzk2LWI5MzEtNWQ5OTkxZWZkOWZmIn0.AYN8YJ9DIQfviQMKlfQjzPBKmMuzYekWuVmsg97E1m03lFnxGkmqJw5rBh-b9dOjJRzEOVxwE9BJQ2NxmqVjLaqpAWV3TyB7-xxajzpEqQJLRCXWPncQAdzc70DhQxGlCLDn1jK9_D9ENh-YzwheISzFuGo51yFtNRmmlS9eNVTydK25' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "ATV-1",
  "sequenceId": 1,
  "description": "Navigation robot",
  "password": "test@123",
  "metadata": {}
}'

@Gzerox

[andrechristikan]

Thanks @Gzerox for being responsible and replying to this issue.

Hi @aravindhfinix

Sorry for the late response, here are my thoughts.
In the Dockerfile, we already set the workdir to /app,
so in the .env, there's no need to change it to /app/keys/*. Instead, you need to leave it as /keys/*.

Like this:

AUTH_JWT_ACCESS_TOKEN_PRIVATE_KEY_PATH=/keys/access-token.pem
AUTH_JWT_ACCESS_TOKEN_PUBLIC_KEY_PATH=/keys/access-token.pub

AUTH_JWT_REFRESH_TOKEN_PRIVATE_KEY_PATH=/keys/refresh-token.pem
AUTH_JWT_REFRESH_TOKEN_PUBLIC_KEY_PATH=/keys/refresh-token.pub

[aravindhfinix]

I am already using like this

AUTH_JWT_ACCESS_TOKEN_PRIVATE_KEY_PATH=keys/access-token.pem
AUTH_JWT_ACCESS_TOKEN_PUBLIC_KEY_PATH=keys/access-token.pub

Facing the error while using like this

@andrechristikan

[andrechristikan]

Hi @aravindhfinix,

I see the issue. Could you please share your apis container log?
This will help us with troubleshooting.

Thanks