# Auth0 JWT Malformed, also token is A256GCM

**URL:** <https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076>\
**Category:** Get Help\
**Tags:** authentication-sessions, sessions\
**Created:** [March 8, 2023, 5:46pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076 "2023-03-08T17:46:34Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 8, 2023, 5:46pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/1 "2023-03-08T17:46:34Z")

</div>

![image](https://global.discourse-cdn.com/auth0/original/3X/9/3/930ddc6d176be2529f1a9a33ed8e02dbf9d920dd.png)

This is the problem on the backend (Apollo server)

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 8, 2023, 5:47pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/2 "2023-03-08T17:47:27Z")

</div>

![image](https://global.discourse-cdn.com/auth0/original/3X/3/f/3fd7dbb9df90bde9d1ea8961bd002f4a5aad8a9e.png)

I know i need to provide “audience” but its not helping

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 8, 2023, 5:48pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/3 "2023-03-08T17:48:00Z")

</div>

verifyToken file

const jwt = require(“jsonwebtoken”);  
const jwksClient = require(“jwks-rsa”);

const verifyToken = async (bearerToken) =\> {  
const client = jwksClient({  
jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,  
});

function getJwksClientKey(header, callback) {  
client.getSigningKey(header.kid, function (error, key) {  
const signingKey = key.publicKey || key.rsaPublicKey;  
callback(null, signingKey);  
});  
}

return new Promise((resolve, reject) =\> {  
jwt.verify(  
bearerToken,  
getJwksClientKey,  
{  
audience: process.env.AUDIENCE,  
issuer: `https://${process.env.AUTH0_DOMAIN}/`,  
algorithms: [“RS256”],  
},  
function (err, decoded) {  
if (err) reject(err);  
resolve(decoded);  
}  
);  
});  
};

module.exports = { verifyToken };

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 8, 2023, 5:52pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/4 "2023-03-08T17:52:35Z")

</div>

@dan.woda pls help sir. im stuck on this for a while now…any help will be highly valued.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 8, 2023, 10:24pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/6 "2023-03-08T22:24:23Z")

</div>

Hi @pandeysandeep1190,

See this FAQ: [Why is my access token not a JWT? (Opaque Token)](https://community.auth0.com/t/why-is-my-access-token-not-a-jwt-opaque-token/31028)

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 9, 2023, 4:40am UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/7 "2023-03-09T04:40:14Z")

</div>

Hey @dan.woda , i saw this FAQ, but i dont see how i my apply it to my case… i’m using the getAccessTokenSilently() and passing the token on Apollo server, and it says jwt malformed in the verfifyToken file.  
Can you just provide me with a little detail please? I’ve just started using Auth0

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 9, 2023, 4:47am UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/8 "2023-03-09T04:47:31Z")

</div>

Where actually do i need to provide this audience parameter? 😬

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 9, 2023, 4:59am UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/9 "2023-03-09T04:59:56Z")

</div>

![image](https://global.discourse-cdn.com/auth0/original/3X/c/f/cffecb2946470c557549e027c4ac1783eeda3151.png)

This is how im dong it currently

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 9, 2023, 6:01am UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/10 "2023-03-09T06:01:46Z")

</div>

@dan.woda pls help me out, im actually considering to quit Auth0, this is my first experience and its not really good.

---

<div class="post-metadata">

**Author:** ![pandeysandeep1190](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pandeysandeep1190/32/45235_2.png) [@pandeysandeep1190](https://community.auth0.com/u/pandeysandeep1190)\
**Post date:** [March 9, 2023, 8:10am UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/11 "2023-03-09T08:10:15Z")

</div>

Now i got an error saying consent is required

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 9, 2023, 2:01pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/12 "2023-03-09T14:01:57Z")

</div>

@pandeysandeep1190,

Have you seen this thread?

> <https://github.com/auth0/auth0-react/issues/65>
>
> Hello, 
> 
> I am getting the Error: Consent required while requesting getAccessTo…kenSilently (); this happens only on localhost/https://127.0.0.1:3000/ but on production, it's working fine ( i use AWS amplify). 
> 
> On my react code this is how I request the access token inside an async function
> 
> \`token = await getAccessTokenSilently({
> audience,
> claim,
> });
> 
> Currently, my workaround is to call getAccessTokenWithPopup() if the silent request returns a promise error which would allow me to run the same code without any authentication bypassing on my dev and production. 
> 
> Is there a better way to address this issue? , please do let me know. 
> 
> thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [April 24, 2023, 1:48pm UTC](https://community.auth0.com/t/auth0-jwt-malformed-also-token-is-a256gcm/102076/13 "2023-04-24T13:48:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.