---
title: Runbook — AUTH_KID_UNKNOWN (키 ID 미인식)
category: AUTH
error_codes: [AUTH_KID_UNKNOWN]
severity: P2
owner: oncall
last_updated: 2026-06-15
status: stub
---

# Runbook: AUTH_KID_UNKNOWN (`runbook://auth/kid-unknown`)

## Symptoms

- HTTP 401 with `error.code=AUTH_KID_UNKNOWN`, `retryable=true`
- Token `kid` header not present in cached JWKS

## Diagnosis

- Check if IdP key rotation occurred recently
- Verify JWKS cache TTL and refresh timing

## Action

- Force JWKS cache refresh
- Confirm new key is published in IdP JWKS endpoint

## Escalation

- Escalate to IdP team if new kid not appearing in JWKS after 10 minutes

---

> **Stub**: Phase D2 — author body after domain adoption. (feature-operational-runbook-contract D9)