Token Signing Key Set Unreadable

URI: https://docs.ankatech.co/errors/token-signing-key-set-unreadable
HTTP Status: 500 Internal Server Error

When you see this

admin-api read a stored document of the user-token signing key set and could not admit it. The custody root answered, so this is not an outage: the stored state itself is corrupted, foreign or incomplete, and a retry reads the same bytes and fails the same way. Nothing was changed.

It is distinct from the 503 answers of the same operations — token-signing-key-custody-unavailable, token-signing-key-set-not-initialized and backend-not-bound — which are transient.

Common Causes

• The stored envelope failed authentication: it does not parse, or its AEAD tag does not verify under the bound deployment KEK — for example a row restored from another environment.
• The envelope unsealed, but the recovered document is not a sound key set or status.
• The status document is missing while the key set exists.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-signing-key-set-unreadable",
  "title": "Token Signing Key Set Unreadable",
  "status": 500,
  "detail": "A stored token signing key document could not be admitted",
  "instance": "/api/v3/admin/platform/token-signing-keys",
  "timestamp": 1790820180,
  "extensions": {
    "requestId": "4a2c8e1f-7b3d-4f96-a0c5-9d1e6b8f2a73"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The problem names no document content and carries no Retry-After. admin-api logs which stored document was refused.

How to Resolve

1. Do not retry in a loop: the answer will not change until the stored state does.
2. Read admin-api's log for the name of the refused document, and check the deployment_secret_envelopes rows of the token signing key set against the environment's bound deployment KEK.
3. A committed rotation or revocation rewrites the status document; the key set itself must be admissible for either to run.

See Admin API — Platform Token Signing Keys and Token Signing Key Set and Rotation.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.