# SPA client (Angular) gets either Authorized or JWT requires 3 parts

**URL:** <https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660>\
**Category:** Get Help\
**Tags:** angular2, hapi, jwt-validation, express\
**Created:** [July 26, 2017, 10:31am UTC](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660 "2017-07-26T10:31:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![matthew.barben](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@matthew.barben](https://community.auth0.com/u/matthew.barben)\
**Post date:** [July 26, 2017, 10:31am UTC](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660/1 "2017-07-26T10:31:12Z")

</div>

Hi There,  
I have a simple scenario (well I think so). An angular client authenticates via Auth0 and then uses the resulting token to authenticate against our own REST API.

However, when using Angular 4 project I continue to get Unauthorised (using “@auth0/angular-jwt”: “^1.0.0-beta.4”) - this is the case regardless of whether I am connecting to my own HAPI server or the express server (built from the example).

To rule out I build out the example Angular App (Angular 2) and used the (“angular2-jwt”: “^0.2.3”,) and instead of unauthorised I get

> Error: JWT must have 3 parts

The Auth service factory is setup, and the auth service is authenticating and setting the token values in the browser

```
  private setSession(authResult): void {
    // Set the time that the access token will expire at
    const expiresAt = JSON.stringify((authResult.expiresIn * 1000) + new Date().getTime());
    const scopes = authResult.scope || this.requestedScopes || '';
    localStorage.setItem('access_token', authResult.accessToken);
    localStorage.setItem('id_token', authResult.idToken);
    localStorage.setItem('expires_at', expiresAt);
    localStorage.setItem('scopes', JSON.stringify(scopes));
  }

```

The only other thing I have hear is to change the id\_token to just simply token, but again this has no effect.

I am out of next steps and would like to clear this hurdle so that I can get back to building out the application.

Thanks in advance

Matthew

---

<div class="post-metadata">

**Author:** ![jmusgrave](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@jmusgrave](https://community.auth0.com/u/jmusgrave)\
**Post date:** [July 28, 2017, 2:08am UTC](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660/2 "2017-07-28T02:08:43Z")

</div>

Sounds like your access token isn’t a JWT. You can paste it into [https://jwt.io/](https://jwt.io/) to verify, but JWTs have 3 or 4 parts separated by “.” characters.

---

<div class="post-metadata">

**Author:** ![matthew.barben](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@matthew.barben](https://community.auth0.com/u/matthew.barben)\
**Post date:** [July 28, 2017, 6:15am UTC](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660/3 "2017-07-28T06:15:00Z")

</div>

using the JWT debugger it will give me an invalid signature simply because I dont have the public / private key - but it can still read it.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:55am UTC](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660/4 "2018-03-02T05:55:37Z")

</div>