# Bad Algorithm Rejection with quickstart 03 -- jQuery calling an API

**URL:** <https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526>\
**Category:** Get Help\
**Tags:** rs256, hs256\
**Created:** [July 14, 2017, 9:45pm UTC](https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526 "2017-07-14T21:45:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pwayner](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@pwayner](https://community.auth0.com/u/pwayner)\
**Post date:** [July 14, 2017, 9:45pm UTC](https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526/1 "2017-07-14T21:45:09Z")

</div>

I pulled down the “Calling an API” example for jQuery, installed it and started it running.

The main page comes up fine but I get an “invalid token” caused by an algorithm snafu. Everything seems to be configured for RS256, but I get this error:

> Object {error: “invalid\_token”,  
> errorDescription: “Algorithm HS256 is  
> not supported. (Expected algs:  
> [RS256])”}error:  
> "invalid\_token"errorDescription:  
> "Algorithm HS256 is not supported.  
> (Expected algs: [RS256])" **proto** :  
> Object  
> Any suggestions would be appreciated.  
> [https://auth0.com/docs/quickstart/spa/jquery/03-calling-an-api](https://auth0.com/docs/quickstart/spa/jquery/03-calling-an-api)

---

<div class="post-metadata">

**Author:** ![Ryan\_Chenkie](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ryan_chenkie/32/5854_2.png) [@Ryan\_Chenkie](https://community.auth0.com/u/Ryan_Chenkie)\
**Post date:** [July 15, 2017, 1:49am UTC](https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526/2 "2017-07-15T01:49:06Z")

</div>

Hi @pwayner

You can choose RS256 as the algorithm for your client in the [settings](https://manage.auth0.com/#/clients).

In the settings for your client, choose **Show Advanced Settings** \> **OAuth** and choose RS256.

---

<div class="post-metadata">

**Author:** ![pwayner](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@pwayner](https://community.auth0.com/u/pwayner)\
**Post date:** [July 15, 2017, 2:22am UTC](https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526/3 "2017-07-15T02:22:50Z")

</div>

Thanks. That made it possible to log in. Now I’m getting an “insufficient scope” error with a 401. If you have any clues on how to solve that, you know where to find me.

---

<div class="post-metadata">

**Author:** ![Ryan\_Chenkie](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ryan_chenkie/32/5854_2.png) [@Ryan\_Chenkie](https://community.auth0.com/u/Ryan_Chenkie)\
**Post date:** [July 15, 2017, 2:47am UTC](https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526/4 "2017-07-15T02:47:40Z")

</div>

Have you created an API in the dashboard and also created a scope of “read:messages” for it? That’s what the sample uses. Be sure to follow the steps outlined in the [quickstart](https://auth0.com/docs/quickstart/spa/jquery/03-calling-an-api).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:55am UTC](https://community.auth0.com/t/bad-algorithm-rejection-with-quickstart-03-jquery-calling-an-api/7526/5 "2018-03-02T05:55:24Z")

</div>