trouble accessing system API with SYSTEM_OWNER user defined in configuration
āQuestionā
Solved
I am running a self hosted zitadel instance need to use some system API endpoints that require SYSTEM_OWNER permissions. I am running zitadel v4.8.1. I've looked over the docs and set up a user in the config like so:
SystemAPIUser:
- zitadel-admin:
Path: /zitadel-admin.pub
Memberships:
- MemberType: System
Roles:
- "SYSTEM_OWNER"
the .pub file is mounted in to the docker container in read-only. my problem is that when I use zitadel-tools to create a JWT for this user, or when I use any other tool to create a JWT, I get an error stating that the JWT is invalid. checked the JWT with jwt.io and at least as far as the format and the signature, it checks out as valid. I did see in the logs that the error mentioned the "iss" field not being as expected. it was set to the system user name "zitadel-admin" as per the docs and the error says it expected the isntance URL. I tried changing it and it still did not work, but didn't complain about the issuer field.
somebody please enlighten me as to what I'm doing wrong here, I'm on day 3 of trying to make this happen and I'm losing my mind.
here is the error I'm seeing from the logs when the JWT fails:
time="2026-06-04T18:02:40Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:307" error="invalid signature (invalid signature: multiple possible keys match)"
SystemAPIUser:
- zitadel-admin:
Path: /zitadel-admin.pub
Memberships:
- MemberType: System
Roles:
- "SYSTEM_OWNER"
the .pub file is mounted in to the docker container in read-only. my problem is that when I use zitadel-tools to create a JWT for this user, or when I use any other tool to create a JWT, I get an error stating that the JWT is invalid. checked the JWT with jwt.io and at least as far as the format and the signature, it checks out as valid. I did see in the logs that the error mentioned the "iss" field not being as expected. it was set to the system user name "zitadel-admin" as per the docs and the error says it expected the isntance URL. I tried changing it and it still did not work, but didn't complain about the issuer field.
somebody please enlighten me as to what I'm doing wrong here, I'm on day 3 of trying to make this happen and I'm losing my mind.
here is the error I'm seeing from the logs when the JWT fails:
time="2026-06-04T18:02:40Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:307" error="invalid signature (invalid signature: multiple possible keys match)"
