Receiving Encrypted JWTs (JWE) Instead of RS256-Signed JWTs with Regular Web App and OAuth

Help
,
1

I’m building a ChatGPT custom action and using Auth0 for user authentication with OAuth. I’m running into a persistent issue where I’m receiving encrypted JWTs (JWE) with alg: dir and enc: A256GCM instead of the expected RS256-signed JWTs. I’ve working on this a day and a half

Here’s a breakdown of my setup:

  • Auth0 Application Type: Regular Web Application
  • Grant Types: Authorization Code, Refresh Token (Client Credentials DISABLED)
  • Custom Domain: Yes (login.bidoptimize.ai), verified with valid SSL. ( I will want to revert back to a non-custom domain, if it is not worth it).
  • OpenAI Custom GPT Actions Configuration: Configured with OAuth, Client ID, Client Secret, correct authorization URL, and token URL.

What I’ve Tried:

  • Double-checked the Token Signature Algorithm settings in Auth0 (set to RS256 at API settings and checked for any other global settings).
  • Disabled the Client Credentials grant type on my Auth0 application.
  • Manually inspected the redirect URL to ensure the redirect_uri parameter matches my allowed callback URLs.
  • Verified my DNS and SSL configuration for the custom domain using online checkers.
  • Force re-authentication and Cleared my Cache.

Additional Details:

  • My Auth0 account is a free account.
  • The “Application Login URI” is currently empty, as I am not using Classic Universal Login.
  • We used Resource Owner Password flow which returned an RS256 signed JWT.

Despite the basic things, the tokens given are still in JWE format, which causes authentication errors in my FastAPI backend (which expects RS256).

Any assistance on where to investigate further would be greatly appreciated!

3

Hi @dan22,

Welcome to the Auth0 Community and thank you for posting your question !

Firstly when receiving a JWE you must ensure that you are not actually getting an opaque token, which happens when you are not providing the correct ApiIdentifier to the request you are making, meaning passing the right 'aud' parameter, as mentioned in our Knowledge Article.

In our docs for Jason Web Encryption ( JWE ) it is mentioned that:

the resource server must decrypt and validate the JWE token

Since you are using the Resource Owner Password Flow with Client Credentials disabled and you are only getting a JWE instead of an actual JWT you’ll also have to follow the guidelines on how to configure a private key for JWT authentication, as mentioned in our documentatation for this particular flow. This can be done by generating an RSA Key Pair, process that can be handled directly from the Auth0 Dashboard.

Finally, in order to get the access token you’ll have to authenticate the JWE using the key pair that was previously generated, so please follow this documentation as well.

Additionally you can also check our our link for more information on how to retrieve an Access Token.

I hope this helped.
Best regards,
Remus