# Jwt malformed even though its correct in the request

**URL:** <https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [November 12, 2024, 8:55pm UTC](https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376 "2024-11-12T20:55:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakebball11](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jakebball11/32/62105_2.png) [@jakebball11](https://community.auth0.com/u/jakebball11)\
**Post date:** [November 12, 2024, 8:55pm UTC](https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376/1 "2024-11-12T20:55:49Z")

</div>

I am trying to setup a backend and use an expressJwt middleware but keep getting the error “jwt malformed”. Even though, as you can see in my screenshot, my token format is correct with “Bearer [token]”.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/3/8/38f522b8be87489951643bfa027951afe065f9ac.png)

This is running on a simple express.js server and I am getting the error “UnauthorizedErrorL jwt malformed”

```auto

import dotenv from 'dotenv';
import express from 'express';
import authRouter from './api/auth';
import { expressjwt, GetVerificationKey } from 'express-jwt';
import jwksRsa from 'jwks-rsa';

dotenv.config();

const app = express();

app.use(express.json());

app.use(
  expressjwt({
    secret: jwksRsa.expressJwtSecret({
      jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`, // JWKS URL from Auth0
    }) as GetVerificationKey , 
    algorithms: ['RS256'],
    audience: process.env.AUTH0_AUDIENCE, 
    issuer: `https://${process.env.AUTH0_DOMAIN}/`,
  }).unless({ path: ['/login', '/signup'] })
);

app.use('/auth', authRouter);

// Define the port
const PORT = process.env.PORT || 3000;

// Start the server
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

```

---

<div class="post-metadata">

**Author:** ![marybeth.hunter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marybeth.hunter/32/61955_2.png) [@marybeth.hunter](https://community.auth0.com/u/marybeth.hunter)\
**Post date:** [November 12, 2024, 10:10pm UTC](https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376/3 "2024-11-12T22:10:50Z")

</div>

Hi @jakebball11,

Welcome to the Auth0 Community!

Can you provide the value of your audience parameter?

Best,

Mary Beth

---

<div class="post-metadata">

**Author:** ![jakebball11](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jakebball11/32/62105_2.png) [@jakebball11](https://community.auth0.com/u/jakebball11)\
**Post date:** [November 12, 2024, 10:43pm UTC](https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376/4 "2024-11-12T22:43:46Z")

</div>

![image](https://global.discourse-cdn.com/auth0/original/3X/0/5/0529bacf11288e9cdc19a61c26291bd01c7a76b3.png)

As you can see the audience is the correct api.

I am not sure if this is useful but passing my access token into [jwt.io](http://jwt.io) says its an invalid signature, is that usual? I am not sure since i dont know if access tokens are meant to be valid JWTs

---

<div class="post-metadata">

**Author:** ![marybeth.hunter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marybeth.hunter/32/61955_2.png) [@marybeth.hunter](https://community.auth0.com/u/marybeth.hunter)\
**Post date:** [November 14, 2024, 11:20pm UTC](https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376/5 "2024-11-14T23:20:37Z")

</div>

Hi @jakebball11,

Thanks for the additional information!

I see that you are using the Management API as your audience value. Can you create an API in your Auth0 Dashboard following these [steps](https://auth0.com/docs/get-started/auth0-overview/set-up-apis)? Additionally, please see this guide Express guide: [Auth0 Node (Express) API SDK Quickstarts: Authorization](https://auth0.com/docs/quickstart/backend/nodejs/01-authorization)

Let me know how that goes!

Thanks,

Mary Beth

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 28, 2024, 11:21pm UTC](https://community.auth0.com/t/jwt-malformed-even-though-its-correct-in-the-request/151376/6 "2024-11-28T23:21:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.