Getting RS256 token instead of HS256

I’ve the same problem mentioned here

I changed the JSON Web Token (JWT) Signature Algorithm under the App advanced setting from RS256 to HS256 but I still get a RS256 token.

The tenant name is esc-py

The application name is esc-py

An example token is this:


Accordingly to and jsonwebtoken library is still RS256

Hi there @giovannilaperna!

Are you setting an audience to be a custom/external API that you’ve added in your Auth0 Dashboard? If so, you may need to re-create the API and change the signing algorithm.

Keep us posted!

Hi tyf,

Thanks for replying but I’m not sure I get your message.

The audience is the default one,

And the only API I have is the default one, Auth0 Management API

I used this API only to configure a custom SMS gateway for the app.

Changing the Signing Algorithm is disabled for that API (as in your screenshot).

If I create a new API, I can choose a HS256 Signing Algorithm, but I have also to provide a new Identifier and I have no idea how to choose it.

Which URL should I provide? I can’t provide again.

What should I do in this case?

I switched back to RS256 for now and everything works correctly.

No problem I’m happy to help where I can and thanks for following up!

I’d be curious as to the need for HS256 in your use case? The default (and recommended) signing algorithm is RS256 as you’ve noticed. Some more on signing algorithms in particular can be found in this FAQ:

When registering an API in Auth0 the identifier is typically the URL of the API that the API as it exists in Auth0 represents. Basically, you would use this identifier as the audience in an authorization flow where the token returned is verified on your end for said API. The following article goes into more detail regarding the validation of Access Tokens by an API:

Hope this helps at least clear things up a bit!

1 Like

The reason was really silly:

I thought that storing the Client Secret as an environment variable was easier then the multiline certificate and for RS256 I was expecting to find a certificate starting with -----BEGIN PUBLIC KEY BLOCK-----.

But now I set the RS256 with the provided certificate and everything works correctly.

Thank you for your assistance!

1 Like

Great! Happy to hear everything works correctly and thanks for confirming here :smile:

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.