feat(core): improve roundtripper error message

CHANGELOG.md

@@ -1,3 +1,7 @@
+## Release (2025-XX-YY)
+- `core`: [v0.17.1](core/CHANGELOG.md#v0171-2025-04-09)
+  - **Improvement:** Improve error message for key flow authentication
+
 ## Release (2025-04-09)
 - `cdn`: [v0.3.0](services/cdn/CHANGELOG.md#v030-2025-04-04)
   - **New:** Add waiter for creation of `CustomDomain`

core/CHANGELOG.md

@@ -1,3 +1,6 @@
+## v0.17.1 (2025-04-09)
+- **Improvement:** Improve error message for key flow authentication
+
 ## v0.17.0 (2025-03-25)
 - **New:** Helper functions for generic openapi error codes
 

core/clients/key_flow.go

@@ -6,10 +6,12 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -209,7 +211,14 @@ func (c *KeyFlow) GetAccessToken() (string, error) {
 	if !accessTokenExpired {
 		return accessToken, nil
 	}
-	if err := c.recreateAccessToken(); err != nil {
+	if err = c.recreateAccessToken(); err != nil {
+		var oapiErr *oapierror.GenericOpenAPIError
+		if ok := errors.As(err, &oapiErr); ok {
+			reg := regexp.MustCompile("Key with kid .*? was not found")
+			if reg.Match(oapiErr.Body) {
+				err = fmt.Errorf("check if your configured key is valid and if the token endpoint is configured correct: %w", err)
+			}
+		}
 		return "", fmt.Errorf("get new access token: %w", err)
 	}