# JWT.io **URL:** https://community.auth0.com/c/jwt/8.md?page=3 [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) **Page:** 4 --- ## [Why I'm getting : JsonWebTokenError: jwt malformed](https://community.auth0.com/t/why-im-getting-jsonwebtokenerror-jwt-malformed/106115)
**Author:** [@dominic.bouchard.355](https://community.auth0.com/u/dominic.bouchard.355)\ **Replies:** 3\ **Last updated:** [May 8, 2023, 8:34pm UTC](https://community.auth0.com/t/why-im-getting-jsonwebtokenerror-jwt-malformed/106115 "2023-05-08T20:34:33Z")
Hi, I recently updated my server to use Apollo Server v4. Since then I’ve been unable to verify my token. I keep getting the :JsonWebTokenError: jwt malformed. I just don’t know why!! Here’s my server code: import { A… --- ## [How to verify that a JWT is legit?](https://community.auth0.com/t/how-to-verify-that-a-jwt-is-legit/105458)
**Author:** [@Ilanoh](https://community.auth0.com/u/Ilanoh)\ **Replies:** 3\ **Last updated:** [May 1, 2023, 1:24pm UTC](https://community.auth0.com/t/how-to-verify-that-a-jwt-is-legit/105458 "2023-05-01T13:24:33Z")
Hello, I receive an ID Token when a user login to the app. I want to check in my server that the JWT is valid. And then show to my user some specific datas that are not stored with auth0 from my server. Is there a wa… --- ## [我想生成修改密码的ticket的url，可是一直报400错误](https://community.auth0.com/t/ticket-url-400/105368)
**Author:** [@kixyouken](https://community.auth0.com/u/kixyouken)\ **Replies:** 1\ **Last updated:** [April 25, 2023, 12:53pm UTC](https://community.auth0.com/t/ticket-url-400/105368 "2023-04-25T12:53:50Z")
url := "https://test.xx.jp/api/v2/tickets/password-change" payload := strings.NewReader("{\\"user\_id\\": \\"auth0|64265f14712a5faae1efefsfe\\"}") req, \_ := http.NewRequest("POST", url, payload) req.Header.Add("content-typ… --- ## [How jwt debugger can decode my jwt token](https://community.auth0.com/t/how-jwt-debugger-can-decode-my-jwt-token/103928)
**Author:** [@somen8099](https://community.auth0.com/u/somen8099)\ **Replies:** 1\ **Last updated:** [April 7, 2023, 12:58pm UTC](https://community.auth0.com/t/how-jwt-debugger-can-decode-my-jwt-token/103928 "2023-04-07T12:58:02Z")
as we know to decode a jwt token i must provide the secret key but when i paste my jwt token to the jwt debugger in this website i get my decoded data how is this possible,this means if somehow i got access to any jwt to… --- ## [I am not getting email from my accessToken](https://community.auth0.com/t/i-am-not-getting-email-from-my-accesstoken/103322)
**Author:** [@olusanya](https://community.auth0.com/u/olusanya)\ **Replies:** 1\ **Last updated:** [March 29, 2023, 7:54pm UTC](https://community.auth0.com/t/i-am-not-getting-email-from-my-accesstoken/103322 "2023-03-29T19:54:33Z")
Hello, I am using NextJS for frontend and NestJS for backend. I created a custom claim to get email in my acessToken. exports.onExecutePostLogin = async (event, api) =\> { // This adds the authenticated user's email a… --- ## [Can JWT easily be hacked by Debugger?](https://community.auth0.com/t/can-jwt-easily-be-hacked-by-debugger/102259)
**Author:** [@Tone](https://community.auth0.com/u/Tone)\ **Replies:** 3\ **Last updated:** [March 28, 2023, 12:03am UTC](https://community.auth0.com/t/can-jwt-easily-be-hacked-by-debugger/102259 "2023-03-28T00:03:40Z")
This is probably a super noob question, so please bear with. I’m using the jsonwebtoken library in Node to generate a JWT. I can copy and past this token into the debugger at jwt.io and see my header and all my payload … --- ## [Go server - need help to verify Auth0 token from React (frontend) and get the userId](https://community.auth0.com/t/go-server-need-help-to-verify-auth0-token-from-react-frontend-and-get-the-userid/99927)
**Author:** [@oded1](https://community.auth0.com/u/oded1)\ **Replies:** 3\ **Last updated:** [March 27, 2023, 1:36pm UTC](https://community.auth0.com/t/go-server-need-help-to-verify-auth0-token-from-react-frontend-and-get-the-userid/99927 "2023-03-27T13:36:58Z")
Hi, Our setup is a React app on the frontend which uses ‘@auth0/auth0-spa-js’ library to connect the user to our Auth0 account. On the backend we have a Go server which exposes our company API services. My goal is to … --- ## [Log in works but spits a invalid JWT?](https://community.auth0.com/t/log-in-works-but-spits-a-invalid-jwt/102383)
**Author:** [@fyll](https://community.auth0.com/u/fyll)\ **Replies:** 3\ **Last updated:** [March 22, 2023, 1:55pm UTC](https://community.auth0.com/t/log-in-works-but-spits-a-invalid-jwt/102383 "2023-03-22T13:55:57Z")
After “loginWithRedirect” in React i get the access token using getAccessTokenSilently but it does not return a valid JWT Here we injected the Auth0Provider into the app import React from "react" import { useNavigate … --- ## [Auth0 SPA Session TTL](https://community.auth0.com/t/auth0-spa-session-ttl/102017)
**Author:** [@joe.a](https://community.auth0.com/u/joe.a)\ **Replies:** 2\ **Last updated:** [March 13, 2023, 7:32pm UTC](https://community.auth0.com/t/auth0-spa-session-ttl/102017 "2023-03-13T19:32:00Z")
It seems that every auth session lifetime, and issuance of access tokens is related to the values set for the Login Session Management in the tenant. If a user is authenticated and has a login session they can get access… --- ## [Hmac using .NET 6.0](https://community.auth0.com/t/hmac-using-net-6-0/101917)
**Author:** [@rguararra](https://community.auth0.com/u/rguararra)\ **Replies:** 13\ **Last updated:** [March 13, 2023, 6:01pm UTC](https://community.auth0.com/t/hmac-using-net-6-0/101917 "2023-03-13T18:01:00Z")
I am trying to duplicate this line from the jwt documentation in .NET 6.0 using C# hmac(${encodedHeader}.${encodedPayload}, secret, sha256); I cannot seem to find the correct library that allows me to produce this code… --- ## [What is the best practice to save token?](https://community.auth0.com/t/what-is-the-best-practice-to-save-token/101630)
**Author:** [@anxhelocenollari](https://community.auth0.com/u/anxhelocenollari)\ **Replies:** 1\ **Last updated:** [March 6, 2023, 10:11pm UTC](https://community.auth0.com/t/what-is-the-best-practice-to-save-token/101630 "2023-03-06T22:11:12Z")
When i first started working with java springboot and jwt implementation i heard from every tutorial that token is stateless and must be saved on Authorization header for each request. But many people are telling me to … --- ## [Get JWT token for logged in user, without a secret?](https://community.auth0.com/t/get-jwt-token-for-logged-in-user-without-a-secret/101263)
**Author:** [@StuStu](https://community.auth0.com/u/StuStu)\ **Replies:** 1\ **Last updated:** [February 25, 2023, 1:04am UTC](https://community.auth0.com/t/get-jwt-token-for-logged-in-user-without-a-secret/101263 "2023-02-25T01:04:18Z")
I have a Quasar (Vue 3) SPA, that authenticates with Auth0. This works great! \[ SPA \] loginWithRedirect() → \[ Auth0 \] → Logged in. I have now added an API (PostgREST) into the mix. PostgREST is a REST API wrapper for… --- ## [AuthHttpInterceptor doesn't add token to authorization header - Error 401 unauthorized - Angular](https://community.auth0.com/t/authhttpinterceptor-doesnt-add-token-to-authorization-header-error-401-unauthorized-angular/97652)
**Author:** [@antonia7](https://community.auth0.com/u/antonia7)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 2:32pm UTC](https://community.auth0.com/t/authhttpinterceptor-doesnt-add-token-to-authorization-header-error-401-unauthorized-angular/97652 "2023-01-13T14:32:27Z")
Hi everyone, I need help with a problem adding token to the authorization header in an Angular HttpClient call, the token doesn’t work and I get a 401 “unauthorized” error. I followed this documentation to implement the… --- ## [Testing backend endpoints that require bearer token?](https://community.auth0.com/t/testing-backend-endpoints-that-require-bearer-token/100767)
**Author:** [@bigpotato](https://community.auth0.com/u/bigpotato)\ **Replies:** 1\ **Last updated:** [February 17, 2023, 9:56pm UTC](https://community.auth0.com/t/testing-backend-endpoints-that-require-bearer-token/100767 "2023-02-17T21:56:56Z")
Hi I am trying to test my backend API, which expects a valid auth0 access token. What is the convention around this? Is there a way I can generate a token programmatically for a user with specific permissions without h… --- ## [Secure a FastAPI Server with Auth0 - Invalid User](https://community.auth0.com/t/secure-a-fastapi-server-with-auth0-invalid-user/81386)
**Author:** [@JaimeFabian](https://community.auth0.com/u/JaimeFabian)\ **Replies:** 4\ **Last updated:** [February 17, 2023, 7:45am UTC](https://community.auth0.com/t/secure-a-fastapi-server-with-auth0-invalid-user/81386 "2023-02-17T07:45:50Z")
Hi everyone, I’m setting up a server with FastAPI and I want to secure its endpoints using Auth0. I’ve followed and implemented this article Build and Secure FastAPI Server with Auth0 and also this video How to Protect… --- ## [Refresh token implementation](https://community.auth0.com/t/refresh-token-implementation/99767)
**Author:** [@IsoardiMarius](https://community.auth0.com/u/IsoardiMarius)\ **Replies:** 2\ **Last updated:** [February 14, 2023, 10:13am UTC](https://community.auth0.com/t/refresh-token-implementation/99767 "2023-02-14T10:13:42Z")
Hello everyone, I thank you in advance for your patience and for the time you give me. I’ll explain my problem to you, I’d like to set up a refresh token, because currently, when a user logs in, the lifespan of the toke… --- ## [fastAPI package to check JWT permissions in offline scop](https://community.auth0.com/t/fastapi-package-to-check-jwt-permissions-in-offline-scop/99436)
**Author:** [@chaitanya.tyagi](https://community.auth0.com/u/chaitanya.tyagi)\ **Replies:** 3\ **Last updated:** [February 7, 2023, 1:52pm UTC](https://community.auth0.com/t/fastapi-package-to-check-jwt-permissions-in-offline-scop/99436 "2023-02-07T13:52:49Z")
I want to authorise a user based on the permissions in there JWT token but while using the offline flow the scope is set to offline\_access whereas if I use the client credential flow, all my permissions are present in th… --- ## [httpInterceptor does not add authorization header](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049)
**Author:** [@guillaume.canu78](https://community.auth0.com/u/guillaume.canu78)\ **Replies:** 3\ **Last updated:** [January 31, 2023, 11:45pm UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049 "2023-01-31T23:45:47Z")
Hello, I know this topics has been asked many times already but I did not find a solution. I followed all steps from Auth0 turials to add Auth0 authentication on an Angular App, but after many hours, I can’t do a reques… --- ## [JWT creation using RS256](https://community.auth0.com/t/jwt-creation-using-rs256/49024)
**Author:** [@creative\_coder](https://community.auth0.com/u/creative_coder)\ **Replies:** 1\ **Last updated:** [January 26, 2023, 9:02pm UTC](https://community.auth0.com/t/jwt-creation-using-rs256/49024 "2023-01-26T21:02:24Z")
I’m trying to create a JWT using RS256. I’ve generated a public and private certificates. .NET core is used to create the JWT. The following are the steps that I’m using to create the JWT. var header = base64URLencode(… --- ## [Custom variable input in getTokenSilently](https://community.auth0.com/t/custom-variable-input-in-gettokensilently/98504)
**Author:** [@JohnWick](https://community.auth0.com/u/JohnWick)\ **Replies:** 1\ **Last updated:** [January 19, 2023, 6:18pm UTC](https://community.auth0.com/t/custom-variable-input-in-gettokensilently/98504 "2023-01-19T18:18:12Z")
Hey ! Im trying to add custom variables to a JWT using the react auth0 SDK, but I want the front end req to specify the values. I am making the req from the front end like: const accessToken = await getAccessTokenSile… --- ## [JWT verifier exception: com.auth0.jwt.exceptions.JWTDecodeException: The token was expected to have 3 parts, but got 5](https://community.auth0.com/t/jwt-verifier-exception-com-auth0-jwt-exceptions-jwtdecodeexception-the-token-was-expected-to-have-3-parts-but-got-5/98398)
**Author:** [@sandervaneck](https://community.auth0.com/u/sandervaneck)\ **Replies:** 1\ **Last updated:** [January 19, 2023, 5:23pm UTC](https://community.auth0.com/t/jwt-verifier-exception-com-auth0-jwt-exceptions-jwtdecodeexception-the-token-was-expected-to-have-3-parts-but-got-5/98398 "2023-01-19T17:23:47Z")
What goes wrong? I am passing the token received from the front end here --- ## [Implementing Auth0 using JWT Token only](https://community.auth0.com/t/implementing-auth0-using-jwt-token-only/98370)
**Author:** [@lakshya](https://community.auth0.com/u/lakshya)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 9:11pm UTC](https://community.auth0.com/t/implementing-auth0-using-jwt-token-only/98370 "2023-01-17T21:11:11Z")
Hello, So I’m trying to build API which works around JWT instead of sessions. const app = express() app.use(auth({ authRequired: false, auth0Logout: true, secret: '', baseURL: 'http://localhost:8080'… --- ## [How do I need to decode secret on jwt.io when using base64 checkbox](https://community.auth0.com/t/how-do-i-need-to-decode-secret-on-jwt-io-when-using-base64-checkbox/97725)
**Author:** [@hferguson](https://community.auth0.com/u/hferguson)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 2:40pm UTC](https://community.auth0.com/t/how-do-i-need-to-decode-secret-on-jwt-io-when-using-base64-checkbox/97725 "2023-01-13T14:40:14Z")
I’ve been testing out various Java libraries for JWT creation. I’ve been using https://jwt.io to test tokens for a REST API where if the token works on jwt.io it will work there. I can get it to work when I don’t check… --- ## [Are tokens generated on jwt.io subject to this exploit?](https://community.auth0.com/t/are-tokens-generated-on-jwt-io-subject-to-this-exploit/97824)
**Author:** [@NickEmpetvee](https://community.auth0.com/u/NickEmpetvee)\ **Replies:** 1\ **Last updated:** [January 11, 2023, 12:08am UTC](https://community.auth0.com/t/are-tokens-generated-on-jwt-io-subject-to-this-exploit/97824 "2023-01-11T00:08:39Z")
Referring to this article, are tokens generated on this site impacted by the exploit mentioned here? It’s talking about version 9.0 but how can we know what version this site uses? --- ## [OAuth 2.0 at+jwt access token](https://community.auth0.com/t/oauth-2-0-at-jwt-access-token/97402)
**Author:** [@charlesb](https://community.auth0.com/u/charlesb)\ **Replies:** 1\ **Last updated:** [January 4, 2023, 11:42pm UTC](https://community.auth0.com/t/oauth-2-0-at-jwt-access-token/97402 "2023-01-04T23:42:50Z")
Hi there. I would like to know how I can to make auth0 generate access tokens with type header “at+jwt” instead of “jwt”. Thank you & BR --- ## [Is there any way to expire or update token time on logout in springboot Project](https://community.auth0.com/t/is-there-any-way-to-expire-or-update-token-time-on-logout-in-springboot-project/96874)
**Author:** [@junaidkhan3k](https://community.auth0.com/u/junaidkhan3k)\ **Replies:** 1\ **Last updated:** [December 23, 2022, 7:30pm UTC](https://community.auth0.com/t/is-there-any-way-to-expire-or-update-token-time-on-logout-in-springboot-project/96874 "2022-12-23T19:30:44Z")
i want this solution as soon as possible please help me out of this --- ## [Python Login Auth0 without app secret key](https://community.auth0.com/t/python-login-auth0-without-app-secret-key/96546)
**Author:** [@ldibello](https://community.auth0.com/u/ldibello)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 10:22pm UTC](https://community.auth0.com/t/python-login-auth0-without-app-secret-key/96546 "2022-12-15T22:22:19Z")
Hi, is there a way to put login form using python but without app.secret.key, because I got another kind of token different that what I get using react. In react just need 3 evs. no client secret, but in python ask me f… --- ## [Add custom information in Access tokens](https://community.auth0.com/t/add-custom-information-in-access-tokens/95700)
**Author:** [@walter.adbe](https://community.auth0.com/u/walter.adbe)\ **Replies:** 4\ **Last updated:** [December 9, 2022, 11:03pm UTC](https://community.auth0.com/t/add-custom-information-in-access-tokens/95700 "2022-12-09T23:03:20Z")
We are facing a specific scenario in the application where we have to add custom information to an access token. I have read the documents that i could find where we can add using Actions and Rules. I was able to add som… --- ## [How to generate JWT for API call using HTTP?](https://community.auth0.com/t/how-to-generate-jwt-for-api-call-using-http/94968)
**Author:** [@gmyuph](https://community.auth0.com/u/gmyuph)\ **Replies:** 5\ **Last updated:** [November 30, 2022, 2:25pm UTC](https://community.auth0.com/t/how-to-generate-jwt-for-api-call-using-http/94968 "2022-11-30T14:25:35Z")
Hello there, I am not a hard-core programmer. I would just want to use the App Store Connect API to automatically download reports. But they use JWT for authentication. I usually just use a normal HTTP call for API calls… --- ## [Is there a way to update the m2m access token so that the scopes are an array rather than a string](https://community.auth0.com/t/is-there-a-way-to-update-the-m2m-access-token-so-that-the-scopes-are-an-array-rather-than-a-string/93533)
**Author:** [@paul10](https://community.auth0.com/u/paul10)\ **Replies:** 4\ **Last updated:** [November 3, 2022, 7:06pm UTC](https://community.auth0.com/t/is-there-a-way-to-update-the-m2m-access-token-so-that-the-scopes-are-an-array-rather-than-a-string/93533 "2022-11-03T19:06:39Z")
This is related to this request which I saw was closed - Change the scope from string to array format in access token. I have the same issue and was wondering if there is a way. We have an integration partner who require… [Previous page](https://community.auth0.com/c/jwt/8.md?page=2) [Next page](https://community.auth0.com/c/jwt/8.md?page=4)