Hi @wwzeitler,
Welcome back!
Sometimes, if you aren’t setting a valid audience param, you will get an encrypted token which would be interpreted as a malformed JWT.
Make sure the audience param you are submitting is actually in the request, and is a valid, registered audience.
You can test the token on JWT.io too, if that helps.