# \#jwt-validation **URL:** https://community.auth0.com/tag/jwt-validation/495.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Replacement of \`lua-resty-jwt\` for https://www.jwt.io/libraries](https://community.auth0.com/t/replacement-of-lua-resty-jwt-for-https-www-jwt-io-libraries/197761)
**Author:** [@cdbattags](https://community.auth0.com/u/cdbattags)\ **Replies:** 2\ **Last updated:** [March 2, 2026, 3:04pm UTC](https://community.auth0.com/t/replacement-of-lua-resty-jwt-for-https-www-jwt-io-libraries/197761 "2026-03-02T15:04:32Z")
Hey folks, I’m the maintainer of lua-resty-jwt, an OpenResty/Lua JWT library. The current listing on jwt.io/libraries points to SkyLothar/lua-resty-jwt, which has been abandoned since May 2020 (70+ open issues, no activ… --- ## [New jwt.io fails to verify signature for HS512](https://community.auth0.com/t/new-jwt-io-fails-to-verify-signature-for-hs512/189278)
**Author:** [@mypascal2000](https://community.auth0.com/u/mypascal2000)\ **Replies:** 1\ **Last updated:** [July 31, 2025, 3:35pm UTC](https://community.auth0.com/t/new-jwt-io-fails-to-verify-signature-for-hs512/189278 "2025-07-31T15:35:11Z")
I generate my jwt token using a token secret such as “tokensecretstring” and HS512. I used to be able to go to “jwt .io” and copy my jwt into left side (all 3 parts) and it would get decoded. And at the bottom in signa… --- ## [Is the endpoint to get the JWK for token validation rate limited?](https://community.auth0.com/t/is-the-endpoint-to-get-the-jwk-for-token-validation-rate-limited/91483)
**Author:** [@a.saad](https://community.auth0.com/u/a.saad)\ **Replies:** 1\ **Last updated:** [September 28, 2022, 6:08pm UTC](https://community.auth0.com/t/is-the-endpoint-to-get-the-jwk-for-token-validation-rate-limited/91483 "2022-09-28T18:08:16Z")
Hello, I have a backend service that needs to validate tokens. I read this guide and it mentions that I should hit the endpoint: https://your-tenant.auth0.com/.well-known/jwks.json in order to retrieve the public key.… --- ## [Access\_token is malformed jwt when authenticating with google-oauth2](https://community.auth0.com/t/access-token-is-malformed-jwt-when-authenticating-with-google-oauth2/74218)
**Author:** [@mattymillar](https://community.auth0.com/u/mattymillar)\ **Replies:** 6\ **Last updated:** [December 6, 2021, 5:24pm UTC](https://community.auth0.com/t/access-token-is-malformed-jwt-when-authenticating-with-google-oauth2/74218 "2021-12-06T17:24:09Z")
I have a web application and I authenticate with google. I get a code back and I exchange it for a token by POST to /oauth/token. I get a successful token response, but when I try decode the access\_token inside I get “… --- ## [Serverless Node.js JWT validation](https://community.auth0.com/t/serverless-node-js-jwt-validation/60378)
**Author:** [@benmarsden](https://community.auth0.com/u/benmarsden)\ **Replies:** 3\ **Last updated:** [April 1, 2021, 3:55pm UTC](https://community.auth0.com/t/serverless-node-js-jwt-validation/60378 "2021-04-01T15:55:23Z")
Which SDK this is regarding: e.g. auth0-react SDK Version: 1.4.0 Platform Version: Node 15 Hey! I am looking for some advice regarding auth0-react server-side usage. I have a simple nextjs application that interacts… --- ## [Testing with JWT validation middleware](https://community.auth0.com/t/testing-with-jwt-validation-middleware/51648)
**Author:** [@marcusb](https://community.auth0.com/u/marcusb)\ **Replies:** 3\ **Last updated:** [October 22, 2020, 3:11pm UTC](https://community.auth0.com/t/testing-with-jwt-validation-middleware/51648 "2020-10-22T15:11:25Z")
So I am implementing a PHP-based API with middleware that checks for the presence of, and verifies JWT access tokens sent via the Authorization request header. The middleware uses the Auth0 PHP SDK to verify and decode t… --- ## [Validating a token using auth0 java-jwt library in Coldfusion; Plz hlp!](https://community.auth0.com/t/validating-a-token-using-auth0-java-jwt-library-in-coldfusion-plz-hlp/42038)
**Author:** [@bentsh](https://community.auth0.com/u/bentsh)\ **Replies:** 0\ **Last updated:** [April 29, 2020, 4:18pm UTC](https://community.auth0.com/t/validating-a-token-using-auth0-java-jwt-library-in-coldfusion-plz-hlp/42038 "2020-04-29T16:18:47Z")
I am trying to validate an ID token retrieved from Azure AD using the OIDC library msal.js. After I retrieve the token, I pass it in a request to the Coldfusion server. On the server I imported the auth0 Java-JWT library… --- ## [Shouldn't JWT notBefore/expiration times be tested against the issuer time?](https://community.auth0.com/t/shouldnt-jwt-notbefore-expiration-times-be-tested-against-the-issuer-time/9308)
**Author:** [@volune](https://community.auth0.com/u/volune)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 4:02am UTC](https://community.auth0.com/t/shouldnt-jwt-notbefore-expiration-times-be-tested-against-the-issuer-time/9308 "2018-03-06T04:02:04Z")
I can’t find any documentation about that. I assume clients and servers, or multiple servers, are not always synchronized between them (and I’ve seen that happen). So if an application tries to validate a JWT from anot… --- ## [JWT access token invalid](https://community.auth0.com/t/jwt-access-token-invalid/9339)
**Author:** [@muneebamughal](https://community.auth0.com/u/muneebamughal)\ **Replies:** 1\ **Last updated:** [February 5, 2018, 2:20pm UTC](https://community.auth0.com/t/jwt-access-token-invalid/9339 "2018-02-05T14:20:02Z")
I am integrating Auth0 with my backend application as an authorisation service. I have created an access token via endpoint oauth/token with client credentials and user’s email and password. Access token generated is ve… --- ## [Calling API with Bear JWT](https://community.auth0.com/t/calling-api-with-bear-jwt/8898)
**Author:** [@cperera](https://community.auth0.com/u/cperera)\ **Replies:** 1\ **Last updated:** [December 7, 2017, 6:20pm UTC](https://community.auth0.com/t/calling-api-with-bear-jwt/8898 "2017-12-07T18:20:56Z")
I an new to Auth0. I am not able to configure the Auth0 to do what I need. I created a new API to represent my Service that will accept the Bear token from clients. I set it up HS256 to use the shared secret. I setup … --- ## [Unable to verify jwt generated by jsrsasign](https://community.auth0.com/t/unable-to-verify-jwt-generated-by-jsrsasign/8768)
**Author:** [@raghava.k2](https://community.auth0.com/u/raghava.k2)\ **Replies:** 0\ **Last updated:** [November 17, 2017, 10:58am UTC](https://community.auth0.com/t/unable-to-verify-jwt-generated-by-jsrsasign/8768 "2017-11-17T10:58:32Z")
Hi we are trying to generate JWT/JWS token from jsrsasign.js library using HS256 algorithm. And we successfully generated the token at front end and able to validate at front end. But when we pass the same token to ser… --- ## [Access\_token invalid signature on jwt.io but not on the React.js tutorial](https://community.auth0.com/t/access-token-invalid-signature-on-jwt-io-but-not-on-the-react-js-tutorial/8545)
**Author:** [@zakiirjuman](https://community.auth0.com/u/zakiirjuman)\ **Replies:** 0\ **Last updated:** [October 22, 2017, 4:43am UTC](https://community.auth0.com/t/access-token-invalid-signature-on-jwt-io-but-not-on-the-react-js-tutorial/8545 "2017-10-22T04:43:00Z")
Hi, Part 3 of the React.js quick start tutorial sets you up with a server listening on :3001 and provides you with the React app code as well. It’s pretty much filled out and all I had to do was set the .env variables a… --- ## [How does a Backend API know which user made a request?](https://community.auth0.com/t/how-does-a-backend-api-know-which-user-made-a-request/8208)
**Author:** [@lars.blumberg](https://community.auth0.com/u/lars.blumberg)\ **Replies:** 3\ **Last updated:** [September 18, 2017, 10:50pm UTC](https://community.auth0.com/t/how-does-a-backend-api-know-which-user-made-a-request/8208 "2017-09-18T22:50:28Z")
I’m having a single page web web application (SPA) that, using the implicit grant flow, gets an access token from auth0. That access token is used when making requests to my API. How does my API know which user has made… --- ## [How to secure API endpoint](https://community.auth0.com/t/how-to-secure-api-endpoint/8224)
**Author:** [@nurlan.nurmanov](https://community.auth0.com/u/nurlan.nurmanov)\ **Replies:** 0\ **Last updated:** [September 18, 2017, 12:32am UTC](https://community.auth0.com/t/how-to-secure-api-endpoint/8224 "2017-09-18T00:32:02Z")
For my website (REACTJS based), I created Spring Boot based REST API. I would like to secure it using JWTs, but from my understanding, JWTs has to be generated on server side. How could I use JWTs when they are generat… --- ## [Weird issues with Azure and jwt tokens](https://community.auth0.com/t/weird-issues-with-azure-and-jwt-tokens/7987)
**Author:** [@robert.bengtsson](https://community.auth0.com/u/robert.bengtsson)\ **Replies:** 0\ **Last updated:** [August 27, 2017, 8:44pm UTC](https://community.auth0.com/t/weird-issues-with-azure-and-jwt-tokens/7987 "2017-08-27T20:44:07Z")
Hello everyone! I’m having the weirdest issues with auth0 and azure mobile services. Some background: I have a small app and website running with Azure App Services as the backend. It has run for a number of years but… --- ## [Why is the returned jwt access token invalid for Resource Server access?](https://community.auth0.com/t/why-is-the-returned-jwt-access-token-invalid-for-resource-server-access/7634)
**Author:** [@omar1](https://community.auth0.com/u/omar1)\ **Replies:** 1\ **Last updated:** [August 3, 2017, 7:40pm UTC](https://community.auth0.com/t/why-is-the-returned-jwt-access-token-invalid-for-resource-server-access/7634 "2017-08-03T19:40:47Z")
I have attempting to gain access to the a Management API via PHP so I can update user details. I’ve create a Resource Server API in my account area, validated the user, provided them with scopes (update:users, create:cli… --- ## [SPA client (Angular) gets either Authorized or JWT requires 3 parts](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660)
**Author:** [@matthew.barben](https://community.auth0.com/u/matthew.barben)\ **Replies:** 2\ **Last updated:** [July 28, 2017, 6:15am UTC](https://community.auth0.com/t/spa-client-angular-gets-either-authorized-or-jwt-requires-3-parts/7660 "2017-07-28T06:15:00Z")
Hi There, I have a simple scenario (well I think so). An angular client authenticates via Auth0 and then uses the resulting token to authenticate against our own REST API. However, when using Angular 4 project I contin… --- ## [Lock for Web: Validating token for subsequent visits](https://community.auth0.com/t/lock-for-web-validating-token-for-subsequent-visits/7550)
**Author:** [@mcarreiro](https://community.auth0.com/u/mcarreiro)\ **Replies:** 2\ **Last updated:** [July 18, 2017, 11:07pm UTC](https://community.auth0.com/t/lock-for-web-validating-token-for-subsequent-visits/7550 "2017-07-18T23:07:55Z")
Hello, I’ve implemented the Lock for Web (lock.min.js v10.4) for my JavaScript/jQuery application and it’s working great for logging in users. However, I currently need to figure out how to validate the token that gets … --- ## [JWT validating correctly for different secrets](https://community.auth0.com/t/jwt-validating-correctly-for-different-secrets/7547)
**Author:** [@jeet.bavishi](https://community.auth0.com/u/jeet.bavishi)\ **Replies:** 1\ **Last updated:** [July 18, 2017, 7:26pm UTC](https://community.auth0.com/t/jwt-validating-correctly-for-different-secrets/7547 "2017-07-18T19:26:44Z")
I am using JWT to generate secure tokens. I am using HS512 algorithm. However, I have found that if I use “ThisIsSecret” as encryption secret and “ThisIsSecretA” as decryption secret it is still validating correctly. Si… --- ## [Getting "This token is not intended for us" when decoding ID Token](https://community.auth0.com/t/getting-this-token-is-not-intended-for-us-when-decoding-id-token/7164)
**Author:** [@mediawebstore](https://community.auth0.com/u/mediawebstore)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 5:29pm UTC](https://community.auth0.com/t/getting-this-token-is-not-intended-for-us-when-decoding-id-token/7164 "2017-07-17T17:29:12Z")
I do a login with Lock and request a id\_token with CURL. It’s all ok until I want to decode the id\_token with verifyAndDecode. I get an error “This token is not intended for us” that I verified is a aud that not match w… --- ## [JWT nov/jose-php Repo](https://community.auth0.com/t/jwt-nov-jose-php-repo/7300)
**Author:** [@akshata.akkanna](https://community.auth0.com/u/akshata.akkanna)\ **Replies:** 1\ **Last updated:** [July 11, 2017, 6:09pm UTC](https://community.auth0.com/t/jwt-nov-jose-php-repo/7300 "2017-07-11T18:09:20Z")
I am using jose-php repo for jwt webtokens rs256. when i pass the encoded value i am getting the correct decoded header and playload but the verify signature is coming in some unknown response type i tried to convert it … --- ## [JWT Decode .NET broke when setting RS256](https://community.auth0.com/t/jwt-decode-net-broke-when-setting-rs256/6773)
**Author:** [@Steve\_McNiven-Scott](https://community.auth0.com/u/Steve_McNiven-Scott)\ **Replies:** 2\ **Last updated:** [May 29, 2017, 8:19pm UTC](https://community.auth0.com/t/jwt-decode-net-broke-when-setting-rs256/6773 "2017-05-29T20:19:37Z")
This is the decode method I was using, worked fine, but when we moved to the RS256 it tanks when “verify” is true. Otherwise everything decodes okay… is this a concern? --- ## [Pull requests socketio-jwt](https://community.auth0.com/t/pull-requests-socketio-jwt/6717)
**Author:** [@dev21](https://community.auth0.com/u/dev21)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 8:19am UTC](https://community.auth0.com/t/pull-requests-socketio-jwt/6717 "2017-05-26T08:19:00Z")
Hello, I was wondering if it would be possible that you take a look at the open pull requests at https://github.com/auth0/socketio-jwt (especially #118 :D) and merge them into your master branch (and update your npm pac… --- ## [Token validation with https://jwt.io/#debugger](https://community.auth0.com/t/token-validation-with-https-jwt-io-debugger/6648)
**Author:** [@ms1](https://community.auth0.com/u/ms1)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 3:18pm UTC](https://community.auth0.com/t/token-validation-with-https-jwt-io-debugger/6648 "2017-05-18T15:18:02Z")
Hello, I have a question. We have developped for our application our own JWT token creator + parser in Java. We used no lib, but just used the Java SDK and followed the relevant RFC spec or other descriptions found else…