Intermittent unauthorized_client Errors
❓Question☁️Zitadel Cloud🪲Bugs✅Solved
Use-case:
Building a Go API that uses ZITADEL for auth. The API validates incoming user access tokens by calling ZITADEL’s /oauth/v2/introspect endpoint using private-key JWT client authentication.
Environment:
ZITADEL Cloud
Tenant: dev-2brzbp.us1.zitadel.cloud
Version:
I’m not sure where to see the exact version.
Stack:
Go API, ZITADEL Cloud, OAuth2 token introspection, private-key JWT client assertion.
Introspection endpoint:
POST https://dev-2brzbp.us1.zitadel.cloud/oauth/v2/introspect
Request uses:
Content-Type: application/x-www-form-urlencoded
client_id=<api app client id>
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion=<signed JWT>
token=<user access token>
What you expected to happen:
Introspection should consistently return 200 OK with active: true for a valid access token.
What went wrong:
I’m seeing intermittent 400 Bad Request responses with:
{"error":"unauthorized_client"}
The confusing part is that I have two introspection requests fired within milliseconds of each other. They use the same tenant, same endpoint, same client_id, same signing key kid, same introspected access token, and same API route. One succeeds and one fails.
Main question: can someone from ZITADEL check those two request IDs and help explain why one private-key JWT introspection request succeeded while the nearly identical one immediately after it failed with unauthorized_client?
Building a Go API that uses ZITADEL for auth. The API validates incoming user access tokens by calling ZITADEL’s /oauth/v2/introspect endpoint using private-key JWT client authentication.
Environment:
ZITADEL Cloud
Tenant: dev-2brzbp.us1.zitadel.cloud
Version:
I’m not sure where to see the exact version.
Stack:
Go API, ZITADEL Cloud, OAuth2 token introspection, private-key JWT client assertion.
Introspection endpoint:
POST https://dev-2brzbp.us1.zitadel.cloud/oauth/v2/introspect
Request uses:
Content-Type: application/x-www-form-urlencoded
client_id=<api app client id>
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion=<signed JWT>
token=<user access token>
What you expected to happen:
Introspection should consistently return 200 OK with active: true for a valid access token.
What went wrong:
I’m seeing intermittent 400 Bad Request responses with:
{"error":"unauthorized_client"}
The confusing part is that I have two introspection requests fired within milliseconds of each other. They use the same tenant, same endpoint, same client_id, same signing key kid, same introspected access token, and same API route. One succeeds and one fails.
Main question: can someone from ZITADEL check those two request IDs and help explain why one private-key JWT introspection request succeeded while the nearly identical one immediately after it failed with unauthorized_client?
