# Unable to verify token in API (seams like a JWE and not a JWT)

**URL:** <https://community.auth0.com/t/unable-to-verify-token-in-api-seams-like-a-jwe-and-not-a-jwt/194091>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [November 5, 2025, 8:07am UTC](https://community.auth0.com/t/unable-to-verify-token-in-api-seams-like-a-jwe-and-not-a-jwt/194091 "2025-11-05T08:07:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pedro.figueiredo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/pedro.figueiredo/32/77338_2.png) [@pedro.figueiredo](https://community.auth0.com/u/pedro.figueiredo)\
**Post date:** [November 5, 2025, 8:07am UTC](https://community.auth0.com/t/unable-to-verify-token-in-api-seams-like-a-jwe-and-not-a-jwt/194091/1 "2025-11-05T08:07:18Z")

</div>

I’m developing and application an integrating with auth0. in our test auth0 env every thing worked fine. We manage to authenticate using react and call our APIs and validate/decode the JWT. Then when we migrated to the company auth0 they send in some configurations to (domain, audience, client secret) and we stopped being able to decode the token. maybe the token is a JWE and not a JWT token.

example token: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIiwiaXNzIjoiaHR0cHM6Ly9nbG9iYWxpZHBkdGEucmFuZHN0YWRzZXJ2aWNlcy5jb20vIn0..EigIjN1nwvdUnlhd.Fh-Qq4WjOFSvWPEaWqcDHJL6wkh0Q\_O\_N98XZbTwFPJxgGC98I-xVQqMjanbl\_-rnzr08rDxmtAdtNJ9nBYQRHSJjJsPKrIKvHCfP6fbzYiqFv7A7eIrryfYSe8EQgXWWGWodx3i8SVmkrfG28lJ4Z-zG171tFAh1Vp5tVwyB5qvSYwPiUQGPpzM1XG1kKYjjjeVMRd1fvp21JSxQoEl3gd3ma7oiux0s\_CjEhH7guL1WFaFmKNCq\_ZJ86awIkyY\_SwGSz\_3EPbeZ3JjrdqNLQCJzublPx9HQwwuLAH8I9hl9An4pf5m-i-M1htybw7rWFQV44ykqJZaBM9kJJO\_cSWtdnoERU3fTUFA.HrWZ3PD7QyK04e5dG9rgRw

first we were using jsonwebtoken with decode and verify but with the new configurations it started to fail (jwt.decode would return null)

then we tried to use node-jose do decrypt the token using the client secret the team provided and we started getting an error “decryption failed” at “const decryptor = await jose.JWE.createDecrypt(keystore);”

The team that manages the Auth0 tenant just send me some configuration with no documentation mainly:

domain (a custom domain)  
clientId  
audience  
client secret

and a link to a json file for OIDC config: custom url… /.well-known/openid-configuration

I’m completely stuck if anyone can please help

---

<div class="post-metadata">

**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\
**Post date:** [November 28, 2025, 6:34pm UTC](https://community.auth0.com/t/unable-to-verify-token-in-api-seams-like-a-jwe-and-not-a-jwt/194091/3 "2025-11-28T18:34:58Z")

</div>

Hi @pedro.figueiredo

Welcome to the Auth0 Community!

Thank you for posting your question, and apologize for the late reply to you. The most common issue why you receive an opaque token (which looks like the JWE) instead of a JWT is the lack of or wrong audience in your `/authorize` call to the Auth0

You can read about the difference here → [Auth0 Support Center](https://support.auth0.com/center/s/article/opaque-versus-jwt-access-token)

The easiest way to fix this issue is to include the audience from the API settings in the Auth0 Dashboard.

Thanks!  
Dawid

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 12, 2025, 6:35pm UTC](https://community.auth0.com/t/unable-to-verify-token-in-api-seams-like-a-jwe-and-not-a-jwt/194091/4 "2025-12-12T18:35:09Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.