Getting 401 "Invalid JWT"

[laxminar...@gmail.com]

Hi, 

I am getting 401 "Invalid JWT" when I try to get access token from postman. I troubleshooted  based on other thread. But still i am getting same response, i am not sure what i am missing. Can you pleas help. Thanks

[laxminar...@gmail.com]

can any one please help on this ? 

[Megan McFeely]

Hello!

Thanks for reaching out! One of our engineers is looking into this issue; we'll have an update for you soon.

Best,
Megan McFeely
DPC Community Manager

[laxminar...@gmail.com]

Thanks you for the response. Please let me know, if you need any information on this

[laxminar...@gmail.com]

Hi, 

Please let me know if any help on this

Thanks

Laxmi

[Megan McFeely]

Hi Laxmi,

Apologies for the delay - I conflated your issue with another invalid JWT token question posted at a similar time. We have an engineer looking at it now, I'll have an answer for you as soon as possible.

[Megan McFeely]

Hi Laxmi,

It looks like you don't have a valid signature on your access token. You can confirm this at jwt.io.

More information about creating a JWT access token is available in the DPC Implementation Guide - I included some of the relevant documentation below.

Creating a JSON Web Token (JWT)

JWT.io provides comprehensive information about what JSON Web Tokens are and how to use them. For testing purposes, the site offers a debugger that allows you to enter a header, payload, and keys to generate a signed JWT.

Online tools for creating JWTs should not be considered secure and should not be used to create tokens to access production data. Instead, use one of the libraries listed on JWT.io to generate JWTs in your DPC API client.

JWT for testing in the sandbox

For the DPC sandbox environment, which contains no PII or PHI, a JWT can be created with the JWT.io debugger. More details on each field can be found under Authentication JWT Header Values and Authentication JWT Claims.

1. From the Algorithm dropdown, select RS384.
2. On the "Decoded" side, the "Header: Algorithm & Token Type" text area must contain a JSON object with the fields below. alg and typ will already be set, so you will need to add kid.
   1. "alg": "RS384" (set for you after you select the algorithm)
   2. "kid": "{ID of public key}"
   3. "typ": "JWT" (set by default)
3. The "Payload: Data" text area must contain a JSON object with the fields below. It will already contain sub, name, admin, and iat. The value of sub will change, and name, admin, and iat should be removed.
   1. "iss": "{client token}"
   2. "sub": "{client token}"
   3. "aud": "https://sandbox.dpc.cms.gov/api/v1/Token/auth"
   4. "exp": "{expiration time}"
   5. "jti": "{nonce}"
4. Under "Verify Signature", the first text area should contain your public key, and the second, your private key. This keypair should be for testing in the sandbox, not one that is used to access any production data.

Thanks!

[laxminar...@gmail.com]

Hi Megan, I followed all the steps for Valid JWT. Signature was verified. I did validated JWT and got 200 response. then I used same JWT to get access token. I was getting "Invalid JWT" response all the time.

{

    "code": 401,

    "message": "Invalid JWT"

}

Thanks 

Laxmi

[laxminar...@gmail.com]

Hi. Any help please. Thanks Laxmi

[hebr...@gmail.com]

Hey Laxmi,

I didn't see anyone mention yet, can you confirm your RSA key has a key length of at least 4096 bits? 

Additionally, make sure the aud claim is set to the production endpoint (https://dpc.cms.gov) even when making the call to the sandbox (https://sandbox.dpc.cms.gov).

Best Regards,

Bryan

[laxminar...@gmail.com]

HI, 

Yes RSA key has a key length of 4096 bits. and aud claim endpoint is pointing to prod URL. 

Thanks

Laxmi

[Calvin Plum]

I am able to generate one without issues. What you seem to be doing is in line with what I am doing, i think! 

[laxminar...@gmail.com]

Hi, 

Not sure what is missing. when I do "/v1/Token/validate" for the JWT. And use the same one for "/v1/Token/auth" getting response as "401 Invalid JWT". I am keeping "exp" time window for 5 min. I am not able to move forward from this point. Please help on this. 

Thanks

Laxmi

[Emily Hart]

Hi Laxmi,

Could you try creating and uploading a new public key, then a new JWT?

Thanks!

Emily Hart

DPC Engineer

[quyon...@gmail.com]

This may help since I had similar issue

1) The root case was that I didn't create JWT with the private key that matches the public key we uploaded to DPC.

2) The validate API doesn't really validate against any key. So even you passed the test of validation, it doesn't mean your JWT is VALID!

Yong