OIDC metadata URL cannot be reached or is invalid error when configuring an OIDC providerIssue When configuring an OIDC provider in Application Registry, the following error appears: "The OIDC Metadata URL specified either cannot be reached or is invalid." This error is related to a missing keys object in the OIDC configuration, which causes OpenID Connect (OIDC) authentication to fail. The system log records a JSONException indicating the jwks_uri endpoint returns an empty response instead of the expected JSON Web Key Set (JWKS). This article covers the cause and resolution for this OIDC, OAuth, and JWKS configuration error. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All versionsCause The system log records the following error: org.json.JSONException: JSONObject["keys"] not found. This indicates the keys object is missing from the OIDC configuration. When the jwks_uri found in the metadata URL is opened in a browser, it returns an empty array []. This is an indication that the OIDC provider has not configured the signing key option. Resolution To resolve this error, verify that the OIDC metadata URL is reachable and that the OIDC provider has a signing key configured. The steps below walk through reproducing the issue in ServiceNow and identifying the root cause in the external OIDC provider. Reproducing the issue in ServiceNow 1.Navigate to Application Registry. 2.Select New. 3.Choose Configure an OIDC provider to verify ID tokens. 4.Select OAuth OIDC Provider Configuration, then select the reference lookup icon. 5.In the new window, select New and enter the OIDC metadata URL in the OIDC Meta Data URL field. 6.Select Submit. The error message appears because the jwks_uri endpoint referenced in the metadata returns an empty keys array. Resolving the empty jwks_uri 1.Open the OIDC metadata URL in a browser. The URL follows the format /.well-known/openid-configuration. 2.Locate the jwks_uri value in the returned JSON. It follows the format /oauth2/v1/keys. 3.Open the jwks_uri URL in a browser. If it returns an empty array [], the signing key has not been configured in the OIDC provider. 4.Log in to the external OIDC provider (for example, Okta) and configure the signing key option. 5.Once the signing key is configured, re-open the jwks_uri URL and confirm it returns a keys array with at least one entry, for example: {"keys":[{"kty":"RSA","alg":"RS256","kid":"...","use":"sig","e":"AQAB","n":"..."}]} 6.Return to ServiceNow Application Registry and re-submit the OIDC provider configuration. If the OIDC metadata URL cannot be reached because the identity provider is internal or behind a firewall, verify that the ServiceNow instance has outbound network access to the endpoint. Also check the oidc_provider_configuration table for duplicate entries if the same metadata URL is already associated with an existing OIDC provider record. Confirm that the OIDC metadata URL is publicly reachable and returns a valid JSON response containing the required claims aud, iss, and sub, and that the URL follows the standard format ending in /.well-known/openid-configuration. Related Links •How to set up an OIDC provider on a ServiceNow instance KB0778342 •Importing OIDC Well Known Configuration Failed — OIDC Metadata URL already configured in another provider KB0858465 •Identity provider does not provide metadata on supported claims KB0760182