Troubleshooting

invalid_token: the API rejects the access token

The token is expired, meant for another audience (aud), issued by another issuer (iss), signed by a key unknown to the API, or the API's clock is off.

invalid_token: the API rejects the access tokeninvalid_token

Cause probable. The token is expired, meant for another audience (aud), issued by another issuer (iss), signed by a key unknown to the API, or the API's clock is off.

What to do? Decode the token in the JWT decoder and compare iss, aud and exp with what the API expects. Check that the API does fetch the provider's public keys (JWKS).

To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.

Related errors

All SAML and OpenID Connect errors

Want to see it for real? ID-Kit plays the role you are missing and shows you each step.

Open my spaceDecode a SAML response