title: ASP.net Core Bearer error="invalid_token", error_description="The signature is invalid"
body: <p>I am using Azure AD for authentication in my ASP.net core app. I can retrieve a token from Azure using postman but when I go to make a request I get the following errror:</p>
  
  <p>"Bearer error="invalid_token", error_description="The signature is invalid""</p>
  
  <p>Setup.cs</p>
  
  <pre><code>namespace CoreDesk.Api
  {
      public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddAuthentication(options =&gt;
              {
                  options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              }).AddJwtBearer(options =&gt;
              {
                  options.Authority = "https://sts.windows.net/7d63a3a5-79de-44c2-b5a3-ec21f4d24329/";
                  options.Audience = "00000003-0000-0000-c000-000000000000";
                  options.TokenValidationParameters.ValidateLifetime = true;
                  options.TokenValidationParameters.ClockSkew = TimeSpan.Zero;
              });
  
              services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                  app.UseHsts();
              }
  
              app.UseCors(builder =&gt; builder
                  .AllowAnyOrigin()
                  .AllowAnyMethod()
                  .AllowCredentials()
                  .AllowAnyHeader());
  
              app.UseAuthentication();
              app.UseMvc();
          }
      }
  }
  </code></pre>