JWT "jwt malformed" in CI token verification

By Kaveh Alemi·Latchkey

The JWT library was handed a string that is not a valid header.payload.signature token. jsonwebtoken raises "JsonWebTokenError: jwt malformed" before any signature check runs.

What this error means

A verification step throws "JsonWebTokenError: jwt malformed". The token variable is empty, still carries a "Bearer " prefix, or is a JSON object rather than the compact token string.

JsonWebTokenError: jwt malformed
    at module.exports [as verify] (/app/node_modules/jsonwebtoken/verify.js:70:17)

Common causes

The "Bearer " prefix was not stripped

The Authorization header value "Bearer eyJ..." was passed verbatim; the verifier needs only the token part.

The token variable is empty or not a compact JWT

A missing secret env, a JSON body, or an undefined value produces a string the parser cannot split into three parts.

How to fix it

Pass only the compact token to verify

1. Strip the "Bearer " scheme before verifying.
2. Assert the token is a non-empty string with two dots.
3. Confirm the token came through the test fixture, not an empty env.

const token = authHeader.replace(/^Bearer /, '');
jwt.verify(token, secret);

Fail the test early on an empty token

Add an assertion that the token is defined and has three dot-separated segments so the failure is obvious.

How to prevent it

• Strip the auth scheme before handing the token to the verifier.
• Assert token shape in test fixtures before verifying.
• Ensure secret and token env vars are populated in the job.

Frequently asked questions

Related guides

References

• GitHub Actions documentation