Why does the token change when private key is entered in verify signature?

[tyf]

Hey there @vivaladata welcome to the community!

Thanks for the detailed description - Not sure how much I can help, but the behavior you’re describing is odd indeed The JWT should only be signed using the private key, not verified.

jwt.io is be able to verify an RS256 jwt by just pasting it into the “Encoded” field - No other action is required:

How is JWT.io able to validate signatures

Hey @elias.nithin , JWT.io figures out the JWKS endpoint of the Identity Provider that issued the token, which will include the X.509 certificate that can be used to validate the signature. The rough algorithm for this would be: Find the iss property of the JWT payload, which usually indicates the issuer’s URL. Read the openid-configuration JSON of issuer by appending /.well-known/openid-configuration. For example, if the issuer is https://example.auth0.com/, the URL to look would be https://…

It’s hard to know what could be going on with the API you are attempting to pass the JWT to, but to my knowledge all validation libraries work this same way.