tech-log-backend/docs/runbooks/auth-kid-unknown.md

title, category, error_codes, severity, owner, last_updated, status

title	category	error_codes	severity	owner	last_updated	status
Runbook — AUTH_KID_UNKNOWN (키 ID 미인식)	AUTH	AUTH_KID_UNKNOWN	P2	oncall	2026-06-15	stub

Runbook: AUTH_KID_UNKNOWN (runbook://auth/kid-unknown)

Symptoms

• HTTP 401 with error.code=AUTH_KID_UNKNOWN, retryable=true
• Token kid header not present in cached JWKS

Diagnosis

• Check if IdP key rotation occurred recently
• Verify JWKS cache TTL and refresh timing

Action

• Force JWKS cache refresh
• Confirm new key is published in IdP JWKS endpoint

Escalation

• Escalate to IdP team if new kid not appearing in JWKS after 10 minutes

---

Stub: Phase D2 — author body after domain adoption. (feature-operational-runbook-contract D9)