# JsonWebToken: jwt malformed even after I get a token is sent

**URL:** <https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672>\
**Category:** JWT.io\
**Tags:** jwt, api, react, auth0\
**Created:** [June 21, 2023, 11:43am UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672 "2023-06-21T11:43:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![DS-LIT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ds-lit/32/48203_2.png) [@DS-LIT](https://community.auth0.com/u/DS-LIT)\
**Post date:** [June 21, 2023, 11:43am UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672/1 "2023-06-21T11:43:36Z")

</div>

Hey, So I have started to build myself a full stack app, at the moment using apollo server, apollo client, graphql , react and Auth0. I have followed every piece of documentation and read so many bugs. I keep getting jwt malformed when I go to verify, even when there is a bearer token and I have no idea why. bellow is what I get when I make a call.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/8/d/8dae4be40ef9c76fbdb2cdc58dcab79135dff0f4.png)

this is my server;

```auto
const apolloServer = new ApolloServer({
  typeDefs,
  resolvers,
});

// connection.once("open", async () => {
const { url } = await startStandaloneServer(apolloServer, {
  context: async ({ req }) => {
    let isAuthenticated = false;
    let token;

    try {
      const authHeader = req.headers.authorization || "";
      if (authHeader) {
        const token = authHeader.split(" ")[1];

        const payload = await verifyToken(token);
        // debugger
        console.log("payload", payload);
        //
        isAuthenticated = payload && payload.sub ? true : false;
        console.log(isAuthenticated);
      }
    } catch (err) {
      console.log(err);
    }
    return { req, auth: { token, isAuthenticated } };
  },
  listen: { port: PORT },
});

console.log(`API server live: ${PORT}!`);
console.log(`GraphQL live: ${url}`);

```

this is verifyToken;

```auto
const verifyToken = async (bearerToken) => {
  const client = jwksClient({
    jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,
  });

  function getJwksClientKey(header, callback) {
    console.log("kid", bearerToken.kid);
    client.getSigningKey(header.kid, function (error, key) {
      const signingKey = key.getPublicKey || key.rsaPublicKey;
      callback(null, signingKey);
    });
  }

  return new Promise((resolve, reject) => {
    console.log(bearerToken);
    jwt.verify(
      bearerToken,
      getJwksClientKey,
      {
        audience: process.env.AUTH0_AUDIENCE,
        issuer: `https://${process.env.AUTH0_DOMAIN}/`,
        algorithms: ["RS256"],
      },
      function (err, decoded) {
        if (err) reject(err);
        resolve(decoded);
      }
    );
  });
};

```

and my app.js

```auto
 const { getAccessTokenSilently, isAuthenticated } = useAuth0();

  const httpLink = new HttpLink({
    uri: REACT_APP_SERVER_URI,
  });

  const authLink = setContext(async (_, { headers, ...rest }) => {
    let bearerToken;
    try {
      bearerToken = await getAccessTokenSilently();
    } catch (err) {
      console.log(err);
    }

    if (!bearerToken) return { headers, ...rest };
    return {
      ...rest,
      headers: {
        ...headers,
        authorization: `Bearer ${bearerToken}`, // Use the bearer schema
        // token ? : "",
      },
    };
  });

  const client = new ApolloClient({
    link: authLink.concat(httpLink),
    cache: new InMemoryCache(),
  });

  return (
    <ApolloProvider client={client}> {children} </ApolloProvider>

```

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [June 21, 2023, 5:59pm UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672/3 "2023-06-21T17:59:16Z")

</div>

Hi @DS-LIT,

Welcome to the Auth0 Community!

I performed a quick test with the access token you tried to verify in your screenshot and found that the error is happening because the payload is not a valid JSON object.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/e/b/eb4b8dc81c39c16f91b35770050321a76954e7b8.png)

Because of that, could you please share with me the exact code and steps you took to get an access token?

For your reference, you might find our [Get Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/get-access-tokens) documentation helpful.

I look forward to your reply.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![DS-LIT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ds-lit/32/48203_2.png) [@DS-LIT](https://community.auth0.com/u/DS-LIT)\
**Post date:** [June 24, 2023, 7:32am UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672/4 "2023-06-24T07:32:46Z")

</div>

Hey Reuben,

bellow is my authprovider

```auto
// config/Auth0Provider.tsx
import React from "react";
import { Auth0Provider } from "@auth0/auth0-react";
import { useNavigate } from "react-router-dom";
import {
  REACT_APP_AUTH0_AUDIENCE,
  REACT_APP_AUTH0_CLIENT_ID,
  REACT_APP_AUTH0_DOMAIN,
} from "../utils/ecosystem.config";

export const Auth0ProviderWithHistory = ({ children }) => {
  // Retrieve the previously created environment variables

  const domain = REACT_APP_AUTH0_DOMAIN;
  const clientId = REACT_APP_AUTH0_CLIENT_ID;
  const audience = REACT_APP_AUTH0_AUDIENCE;

  if (!domain || !clientId)
    throw new Error(
      "Please set REACT_APP_AUTH0_DOMAIN and REACT_APP_AUTH0_CLIENT_ID env. variables"
    );

  const history = useNavigate();

  const onRedirectCallback = (appState) => {
    history(appState?.returnTo || window.location.pathname);
  };

  return (
    <Auth0Provider
      domain={domain}
      clientId={clientId}
      authorizationParams={{
        redirect_uri: window.location.origin,
        audience: audience,
        scope: "read: current_user update:current_user_metadata",
      }}
      onRedirectCallback={onRedirectCallback}
      useRefreshTokens={true}
      cacheLocation="localstorage"
    >
      {children}
    </Auth0Provider>
  );
};

```

---

<div class="post-metadata">

**Author:** ![DS-LIT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ds-lit/32/48203_2.png) [@DS-LIT](https://community.auth0.com/u/DS-LIT)\
**Post date:** [June 24, 2023, 1:04pm UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672/5 "2023-06-24T13:04:05Z")

</div>

with in that I have a apolloProvider that is then allowing me to make a useLazyQuery call

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [June 27, 2023, 7:01pm UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672/6 "2023-06-27T19:01:15Z")

</div>

HI @DS-LIT,

Thanks for the update.

For the moment, your code snippet looks good in constructing the login request correctly. I did notice there was an extra space included in your `read:current_user` scope.

Now, to investigate this issue further, could you please [capture the login events in a HAR file](https://auth0.com/docs/troubleshoot/har) and send them to me as a direct message?

The HAR file will allow me to see the values passed in the login request and see if there are any issues throughout the process.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [July 11, 2023, 7:01pm UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672/7 "2023-07-11T19:01:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.