# Struggling to make a valid modification to JWT "exp" value **URL:** \ **Category:** Get Help\ **Tags:** jwt\ **Created:** [November 14, 2021, 2:08pm UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105 "2021-11-14T14:08:51Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mixelpix](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mixelpix/32/32998_2.png) [@mixelpix](https://community.auth0.com/u/mixelpix)\ **Post date:** [November 14, 2021, 2:08pm UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/1 "2021-11-14T14:08:51Z")
I’m testing things out using cURL with the Zoom API. When I use JWTs generated on the Zoom App Credentials page, the cURL commands work just fine, e.g. a cURL PATCH command for updating the alternative hosts for a meeting: ```auto curl --request PATCH \ --url 'https://api.zoom.us/v2/meetings/1234567890' \ --header 'authorization: Bearer { auth_token } \ --header 'content-type: application/json' \ --data-raw '{ "settings": { "alternative_hosts": "name@fake.email;name2@fake.email;name3@fake.email" } }' ``` When I paste the JWT token created in the Zoom App Credentials page into [JWT.io](http://jwt.io/)’s “Encoded” window, then modify the payload by updating the “exp” value in the “Decoded” window, I get the following error using the updated JWT token string: ```auto {"code":124,"message":"The Token's Signature resulted invalid when verified using the Algorithm: HmacSHA256"} ``` This is the case whether or not I select the “secret base64 encoded” option. This is also the case whether or not I include `"typ": "JWT"` in the header object (per the Zoom specs [here](https://marketplace.zoom.us/docs/guides/auth/jwt#header)). ![Screen Shot 2021-11-14 at 7.15.24 AM](https://global.discourse-cdn.com/auth0/original/3X/7/e/7e9367fd1a474cab39a683b9f7a5d569f4d3a9b7.png) What am I doing wrong and how do I generate a valid JWT with the “exp” value updated through the [JWT.io](http://JWT.io) gui? Apologies for the newB smell. Thanks for your time and consideration! ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [November 15, 2021, 10:45pm UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/3 "2021-11-15T22:45:38Z")
Hi @mixelpix Welcome to the Auth0 Community! You cannot modify an existing token without invalidating the signature. This is the security mechanism that makes JWTs secure. When the token expires you will typically have to request a new one. ---
**Author:** ![mixelpix](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mixelpix/32/32998_2.png) [@mixelpix](https://community.auth0.com/u/mixelpix)\ **Post date:** [November 16, 2021, 5:41pm UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/4 "2021-11-16T17:41:14Z")
Hi @dan.woda , Thanks for the reply… so am I understanding you correctly that if I first create a token which lasts for a week and then create a token which lasts for a day, the first one is invalidated? This seems contradictory to my experience. What I am trying to do on the [JWT.io](http://JWT.io) page is use the gui to generate a new token with a modifiied “exp” value, not manually modify the encoded JWT. Best ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [November 16, 2021, 9:49pm UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/5 "2021-11-16T21:49:00Z")
Thanks for the added context, I think I understand what you are trying to do. > [@mixelpix](#): > > Thanks for the reply… so am I understanding you correctly that if I first create a token which lasts for a week and then create a token which lasts for a day, the first one is invalidated? No, not quite. Either token should be valid, as long as it is signed with the secret provided by zoom and is still within the exp timeframe. Are you putting your secret in the input field? ![image](https://global.discourse-cdn.com/auth0/original/3X/4/3/431ae35ccc9d3b68a2aed7cb23e43a3687ab3369.png) ---
**Author:** ![mixelpix](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mixelpix/32/32998_2.png) [@mixelpix](https://community.auth0.com/u/mixelpix)\ **Post date:** [November 17, 2021, 12:19am UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/6 "2021-11-17T00:19:27Z")
@dan.woda oooooooOOOOOOoooooooo! 🤦‍♂️ That would probably help and is a much more secure gui that way 😅 I’m gonna go cURL up in a ball in the corner for awhile until I am less embarrassed to be seen on teh internets. thanks!! ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [November 17, 2021, 1:03am UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/7 "2021-11-17T01:03:37Z")
Don’t stress! We all have those days 😄 ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [December 2, 2021, 1:04am UTC](https://community.auth0.com/t/struggling-to-make-a-valid-modification-to-jwt-exp-value/73105/8 "2021-12-02T01:04:12Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.