# Id\_token invalid on jwt.io site

**URL:** <https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701>\
**Category:** JWT.io\
**Tags:** jwt\
**Created:** [May 21, 2017, 11:42pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701 "2017-05-21T23:42:12Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 21, 2017, 11:42pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/1 "2017-05-21T23:42:12Z")

</div>

I build into my server The example server code :  
public void ConfigureAuth(IAppBuilder app)  
{  
var domain = $“https://{ConfigurationManager.AppSettings"Auth0Domain”]}/“;  
var apiIdentifier = ConfigurationManager.AppSettings"Auth0ApiIdentifier”];

```
        var keyResolver = new OpenIdConnectSigningKeyResolver(domain);
        app.UseJwtBearerAuthentication(
            new JwtBearerAuthenticationOptions
            {
                AuthenticationMode = AuthenticationMode.Active,
                TokenValidationParameters = new TokenValidationParameters()
                {
                    ValidAudience = apiIdentifier,
                    ValidIssuer = domain,
                    IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) => keyResolver.GetSigningKey(identifier)
                }
            });

        // Configure Web API
        // WebApiConfig.Configure(app);

        var issuer = domain;
        var audience = apiIdentifier;

        byte] byt = System.Text.Encoding.UTF8.GetBytes("MYCLEARTEXTSECRET");
        var secret = Convert.ToBase64String(byt);

        app.UseJwtBearerAuthentication(
           new JwtBearerAuthenticationOptions
           {
               AuthenticationMode = AuthenticationMode.Active,
               AllowedAudiences = new] { audience },
               IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider]
             {
              new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
             },
           });
    }

```

In my Controller I add  
[Authorize]  
[HttpGet]  
[Route(“ping/secure”)]  
public IHttpActionResult PingSecured()  
{  
return Ok(new  
{  
Message = “All good. You only get this message if you are authenticated.”  
}  
);  
}  
Finally from Postman I try to get on server/api/ping/secure with header beaerer set to id\_token  
I get id-token from another client which deserializes var url = “[https://railcomm.auth0.com/oauth/ro](https://railcomm.auth0.com/oauth/ro)” into a class called AuthoBits0, which is simply public class Auth0bits  
{  
[DataMember]  
public string id\_token;  
[DataMember]  
public string access\_token;  
[DataMember]  
public string token\_type;  
}

anyways, this id\_token , when put into [https://jwt.io/](https://jwt.io/) returns invalid.  
The GET with postman passing this id\_token also fails.

---

<div class="post-metadata">

**Author:** ![prashantT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/prashantt/32/6002_2.png) [@prashantT](https://community.auth0.com/u/prashantT)\
**Post date:** [May 22, 2017, 10:08am UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/2 "2017-05-22T10:08:15Z")

</div>

To make secured calls to your API, you should be passing the `access_token` in the Authorization header, rather than the `id_token`. Your API also seems to be configured for HS256 tokens - please ensure that your API in Auth0 is configured to generate HS256 tokens. Note: We highly suggest the use of RS256 tokens rather than HS256; the Quickstart outlines how this can be setup in your API:

**Update:**

In order to call a secured API, you need to use an access\_token that has been obtained from OIDC conformant endpoints, with the appropriate `audience` - /oauth/ro is not an OIDC conformant endpoint. You can use the `/oauth/token` endpoint instead,

> **[Auth0 ASP.NET Web API (OWIN) SDK Quickstarts: Authorization](https://auth0.com/docs/quickstart/backend/webapi-owin)**
>
> This tutorial demonstrates how to add authorization to an ASP.NET OWIN API using the standard JWT middleware.

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 22, 2017, 7:30pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/3 "2017-05-22T19:30:09Z")

</div>

Prashant,  
Thank you. I know I read online that you need to pass id\_token. I’ll try to find that reference and forward it.  
Thanks again  
John

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 22, 2017, 7:48pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/4 "2017-05-22T19:48:33Z")

</div>

Hi Prashant,  
Can you tell me where my API says HS256? I’m following the quickstart from GitHub.  
John

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 22, 2017, 9:37pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/5 "2017-05-22T21:37:16Z")

</div>

Prashant  
My server code is reduced to :  
var domain = $“https://{ConfigurationManager.AppSettings"Auth0Domain”]}/“;  
var apiIdentifier = ConfigurationManager.AppSettings"Auth0ApiIdentifier”];

```
        var keyResolver = new OpenIdConnectSigningKeyResolver(domain);
        app.UseJwtBearerAuthentication(
            new JwtBearerAuthenticationOptions
            {
                AuthenticationMode = AuthenticationMode.Active,
                TokenValidationParameters = new TokenValidationParameters()
                {
                    ValidAudience = apiIdentifier,
                    ValidIssuer = domain,
                    IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) => keyResolver.GetSigningKey(identifier)
                }
            });

```

My auth0 client is configured to RS256

Postmand  
[https://localhost:44309/api/railroads/ping/secure](https://localhost:44309/api/railroads/ping/secure) Authorization header : bearer access\_token

Sill 401 Unauthorized. I use this accent\_token in another client to access Autho0 and it works fine.

The code sample shows :

// Configure Web API  
WebApiConfig.Configure(app);

what does this do … I do not have Configure method on my WebApiConfig , just a Register

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 23, 2017, 1:11am UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/6 "2017-05-23T01:11:05Z")

</div>

Our [ASP.NET](http://ASP.NET) MVC project is newer and seems to have a newer structure. Anyways we are still failing if you have any ideas.

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 22, 2017, 7:30pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/7 "2017-05-22T19:30:09Z")

</div>

Prashant,  
Thank you. I know I read online that you need to pass id\_token. I’ll try to find that reference and forward it.  
Thanks again  
John

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 22, 2017, 7:48pm UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/8 "2017-05-22T19:48:33Z")

</div>

Hi Prashant,  
Can you tell me where my API says HS256? I’m following the quickstart from GitHub.  
John

---

<div class="post-metadata">

**Author:** ![jsheehan](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jsheehan](https://community.auth0.com/u/jsheehan)\
**Post date:** [May 23, 2017, 1:11am UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/9 "2017-05-23T01:11:05Z")

</div>

Our [ASP.NET](http://ASP.NET) MVC project is newer and seems to have a newer structure. Anyways we are still failing if you have any ideas.

---

<div class="post-metadata">

**Author:** ![prashantT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/prashantt/32/6002_2.png) [@prashantT](https://community.auth0.com/u/prashantT)\
**Post date:** [May 23, 2017, 9:21am UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/10 "2017-05-23T09:21:21Z")

</div>

Please see my updated answer above. As a side note, if providing additional information or replying to a comment, please either update the questions, or use the comment feature, rather than posting as an answer.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:54am UTC](https://community.auth0.com/t/id-token-invalid-on-jwt-io-site/6701/11 "2018-03-02T05:54:03Z")

</div>