From d8ef81e9afd4f06f5915dd320e0530ff4622415d Mon Sep 17 00:00:00 2001 From: rock Date: Wed, 28 Oct 2026 01:34:23 -0700 Subject: [PATCH] fix(paperless-ai): ask for no project audience, so aud names the caller The gateway compares the token audience with its allow-list of client ids. The scope carried urn:zitadel:iam:org:project:id::aud, so every token said aud = [396757796898471937] and the gateway answered token validation failed: audience not allowed: [396757796898471937] With plain openid the audience is the machine user, which is the entry that exists on the list. --- k8s/apps/paperless/paperless-ai.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/k8s/apps/paperless/paperless-ai.yaml b/k8s/apps/paperless/paperless-ai.yaml index 81d9e2b..29a62d3 100644 --- a/k8s/apps/paperless/paperless-ai.yaml +++ b/k8s/apps/paperless/paperless-ai.yaml @@ -65,7 +65,12 @@ spec: - --user-id=397072668735570071 - --key-id=397072674272051351 - --key-file=/var/run/llm-key/key - - --scope=openid urn:zitadel:iam:org:project:id:396757796898471937:aud + # No project audience. ZITADEL puts the requested audience in `aud`, and + # the gateway compares `aud` with its allow-list of client ids. Asking for + # the project id made every token carry the project, so the gateway + # answered "audience not allowed: [396757796898471937]". With plain + # `openid` the token names its caller, which is the entry that exists. + - --scope=openid - --out=/app/data/llm_token.txt volumeMounts: - {name: paperless-ai-data, mountPath: /app/data}