JWT "invalid signature" in CI token verification

By Daniel Zoghalchali·Latchkey

The JWT parsed correctly but its signature did not verify against the key you supplied. jsonwebtoken raises "JsonWebTokenError: invalid signature" when the secret, public key, or algorithm differs from signing.

What this error means

Verification throws "JsonWebTokenError: invalid signature". A token signed with one HMAC secret is verified with another, or an RS256 token is verified with the wrong public key.

JsonWebTokenError: invalid signature
    at /app/node_modules/jsonwebtoken/verify.js:171:19

Common causes

A mismatched signing and verifying key

CI signs test tokens with one HMAC secret but verifies with a different one, or uses a stale public key for an RS256 token.

Algorithm mismatch between signer and verifier

The token uses RS256 but verification is attempted with an HMAC secret, or the allowed algorithms list excludes the real one.

How to fix it

Use the same key and algorithm on both sides

1. Sign and verify test tokens with the identical secret or key pair.
2. Pass the correct public key for asymmetric algorithms.
3. Restrict and match the algorithms option to what was used to sign.

jwt.verify(token, publicKey, { algorithms: ['RS256'] });

Fetch the current signing key from JWKS

For provider-issued tokens, resolve the key by kid from the JWKS endpoint so rotation does not break verification.

How to prevent it

• Share one signing secret or key pair between signer and verifier in tests.
• Pin the algorithms option to match how tokens are signed.
• Resolve provider keys from JWKS by kid rather than hardcoding.

Frequently asked questions

Related guides

References

• GitHub Actions documentation