My JWT or session token fails to verify — what's wrong?
- Topic
- Troubleshooting
- Asked by
- Backend developers
Session/JWT verification failures almost always come down to one of these:
Wrong instance or key. The token is signed by one instance but you're verifying against another's JWKS. Make sure your backend uses the same instance's keys as the frontend that issued the token.
Stale JWKS cache. If you rotated signing keys, a cached JWKS can miss the new key. Refresh the JWKS (SDKs do this automatically on an unknown
kid).Clock skew. If your server's clock is off, a valid token can look
exp-expired ornbf-not-yet-valid. Sync via NTP and allow a small leeway.Wrong
aud/iss. Confirm you're validating the audience and issuer that your instance actually sets.Using the wrong token. Verify the session/access token, not a refresh token.
The backend SDKs handle JWKS fetching, caching and rotation for you — prefer them over hand-rolled verification. See session verification.
The usual causes are a JWKS/signing-key mismatch (wrong instance or stale cache), a clock skew making the token look expired, or checking the wrong aud/iss. Verify against your instance's JWKS and confirm the claims.