ValueError: The value api_auth/jwt_secret must be set!

[OleksandrBrukhalskyi]

Apache Airflow version

3.0.1

If "Other Airflow 2 version" selected, which one?

No response

What happened?

I upgraded to Airflow version of 3.0.1 because I had some problem with infinite reloading during sign in in 3.0.0

Now, I have a problem with start up process of airflow-apiserver in Ubuntu Server. But it works in my host machine in Docker.

It throws this exception.

airflow-apiserver-1 | INFO: Started server process [1055] airflow-apiserver-1 | INFO: Waiting for application startup. airflow-apiserver-1 | ERROR: Traceback (most recent call last): airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/starlette/routing.py", line 692, in lifespan airflow-apiserver-1 | async with self.lifespan_context(app) as maybe_state: airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 210, in __aenter__ airflow-apiserver-1 | return await anext(self.gen) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/fastapi/routing.py", line 133, in merged_lifespan airflow-apiserver-1 | async with original_context(app) as maybe_original_state: airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 210, in __aenter__ airflow-apiserver-1 | return await anext(self.gen) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/fastapi/routing.py", line 133, in merged_lifespan airflow-apiserver-1 | async with original_context(app) as maybe_original_state: airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 210, in __aenter__ airflow-apiserver-1 | return await anext(self.gen) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/airflow/api_fastapi/app.py", line 62, in lifespan airflow-apiserver-1 | await stack.enter_async_context( airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 650, in enter_async_context airflow-apiserver-1 | result = await _enter(cm) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 210, in __aenter__ airflow-apiserver-1 | return await anext(self.gen) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/fastapi/routing.py", line 133, in merged_lifespan airflow-apiserver-1 | async with original_context(app) as maybe_original_state: airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 210, in __aenter__ airflow-apiserver-1 | return await anext(self.gen) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/svcs/fastapi.py", line 66, in __call__ airflow-apiserver-1 | async with self.registry, cm(app, self.registry) as state: airflow-apiserver-1 | File "/usr/local/lib/python3.11/contextlib.py", line 210, in __aenter__ airflow-apiserver-1 | return await anext(self.gen) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^ airflow-dag-processor-1 | [2025-05-13T12:26:14.926+0000] {dag.py:1895} INFO - Sync 1 DAGs airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/airflow/api_fastapi/execution_api/app.py", line 94, in lifespan airflow-apiserver-1 | registry.register_value(JWTValidator, _jwt_validator(), ping=JWTValidator.status) airflow-apiserver-1 | ^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/airflow/api_fastapi/execution_api/app.py", line 65, in _jwt_validator airflow-apiserver-1 | **get_sig_validation_args(make_secret_key_if_needed=False), airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/airflow/api_fastapi/auth/tokens.py", line 578, in get_sig_validation_args airflow-apiserver-1 | return {"secret_key": get_signing_key("api_auth", "jwt_secret", make_secret_key_if_needed)} airflow-dag-processor-1 | [2025-05-13T12:26:14.955+0000] {dag.py:2509} INFO - Setting next_dagrun for tutorial_dag to None, run_after=None airflow-apiserver-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ airflow-apiserver-1 | File "/home/airflow/.local/lib/python3.11/site-packages/airflow/api_fastapi/auth/tokens.py", line 535, in get_signing_key airflow-apiserver-1 | raise ValueError(f"The value {section}/{key} must be set!") airflow-apiserver-1 | ValueError: The value api_auth/jwt_secret must be set!

What you think should happen instead?

No response

How to reproduce

I use this Docker image: 3.0.1

Operating System

Ubuntu Server 22.04

Versions of Apache Airflow Providers

No response

Deployment

Docker Compose

Deployment details

Official Docker Compose file for 3.0.1

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[OleksandrBrukhalskyi]

Noticed this in logs from apiserver container:

[warning ] api_auth/jwt_secret was empty, using a generated one for now. Please set this in your config [airflow.api_fastapi.auth.tokens]

[albundy83]

It will be fixed here.
I have the same error than you :)

[OleksandrBrukhalskyi]

Thank you, @albundy83 for your response. This is strange, because Airflow runs successfully in my host machine, but it throws this kind of exception in my docker deployment in Ubuntu Server.

And as far as I understood, it is going to be a new tag in Docker Hub or just fix of current 3.0.1 tag?

[albundy83]

Ah sorry, I read too fast, I thought your were under Kubernetes (I have the exact same issue with 3.0.1).
Maybe you could check this issue: #49871

[OleksandrBrukhalskyi]

@albundy83 thank you for your attention. This #49646 helped me to resolve my problem in Docker deployment. I'll be waiting for future fix to have this token to be generated during init stage of Airflow components.
Closing the issue and thanks again!

[OleksandrBrukhalskyi]

I have this issue with jwt_secret again! the token I generated manually using openssl rand -base64 16 doesn't work in docker compose file. Airflow version is 3.0.2

[Biigode]

Same issue with airflow 3.0.2