dikaioai
diff --git a/‎.changeset/silent-games-joke.md‎
Lines changed: 2 additions & 0 deletions b/‎.changeset/silent-games-joke.md‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎packages/backend/src/tokens/errors.ts‎
Lines changed: 5 additions & 0 deletions b/‎packages/backend/src/tokens/errors.ts‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎packages/backend/src/tokens/keys.ts‎
Lines changed: 32 additions & 1 deletion b/‎packages/backend/src/tokens/keys.ts‎
Lines changed: 32 additions & 1 deletion
diff --git a/‎packages/backend/src/util/request.ts‎
Lines changed: 10 additions & 0 deletions b/‎packages/backend/src/util/request.ts‎
Lines changed: 10 additions & 0 deletions
@@ -0,0 +1,2 @@
+---
+---
@@ -1,5 +1,9 @@
 export type TokenCarrier = 'header' | 'cookie';
 
+export enum TokenVerificationErrorCode {
+  InvalidSecretKey = 'clerk_key_invalid',
+}
+
 export enum TokenVerificationErrorReason {
   TokenExpired = 'token-expired',
   TokenInvalid = 'token-invalid',
@@ -9,6 +13,7 @@ export enum TokenVerificationErrorReason {
   TokenInvalidSignature = 'token-invalid-signature',
   TokenNotActiveYet = 'token-not-active-yet',
   TokenVerificationFailed = 'token-verification-failed',
+  InvalidSecretKey = 'secret-key-invalid',
 
   LocalJWKMissing = 'jwk-local-missing',
 
 
@@ -4,7 +4,13 @@ import { API_URL, API_VERSION, MAX_CACHE_LAST_UPDATED_AT_SECONDS } from '../cons
 import runtime from '../runtime';
 import { callWithRetry } from '../util/callWithRetry';
 import { joinPaths } from '../util/path';
-import { TokenVerificationError, TokenVerificationErrorAction, TokenVerificationErrorReason } from './errors';
+import { getErrorObjectByCode } from '../util/request';
+import {
+  TokenVerificationError,
+  TokenVerificationErrorAction,
+  TokenVerificationErrorCode,
+  TokenVerificationErrorReason,
+} from './errors';
 
 type JsonWebKeyWithKid = JsonWebKey & { kid: string };
 
@@ -202,6 +208,31 @@ async function fetchJWKSFromBAPI(apiUrl: string, key: string, apiVersion: string
   });
 
   if (!response.ok) {
+    const errors = await response.json().then(({ errors }) => {
+      if (!errors) {
+        return false;
+      }
+
+      const invalidSecretKey = getErrorObjectByCode(errors, TokenVerificationErrorCode.InvalidSecretKey);
+
+      if (!invalidSecretKey) {
+        return false;
+      }
+
+      return {
+        ...invalidSecretKey,
+        reason: TokenVerificationErrorReason.InvalidSecretKey,
+      };
+    });
+
+    if (errors) {
+      throw new TokenVerificationError({
+        action: TokenVerificationErrorAction.ContactSupport,
+        message: errors.message,
+        reason: errors.reason,
+      });
+    }
+
     throw new TokenVerificationError({
       action: TokenVerificationErrorAction.ContactSupport,
       message: `Error loading Clerk JWKS from ${url.href} with code=${response.status}`,
 
@@ -78,3 +78,13 @@ function getFirstValueFromHeaderValue(value?: string | null) {
 function getProtocolVerb(protocol: string) {
   return protocol?.replace(/:$/, '') || '';
 }
+
+type ErrorFields = {
+  message: string;
+  long_message: string;
+  code: string;
+};
+
+export const getErrorObjectByCode = (errors: ErrorFields[], code: string) => {
+  return errors.find((err: ErrorFields) => err.code === code);
+};