title: itsdangerous.BadSignature error in token integration using TimedJSONWebSerializer - App Backend Server?
body: <p>I am authenticating the user by a <code>secret_key</code> known only to the backend and the client side and passed through the headers in Postman. My code so far is as follows:</p>
  
  <pre><code>from itsdangerous import TimedJSONWebSignatureSerializer
  from constants import SECRET_KEY
  
  @app.route('/authUser', methods=['POST'])
  def authUser():
      secret_key = request.headers['secret_key']
  
      if secret_key is None:
          return "400"
      elif secret_key != SECRET_KEY: # SECRET_KEY is a constant that has been imported from constants.py
          return "400"
      else:
          s = TimedJSONWebSignatureSerializer(app.config['SECRET_KEY'], expires_in=3600)
          token = s.dumps({'user_id' : user_id})
          print (s.loads(token))
          return token
  </code></pre>
  
  <p>This code throws the following error:</p>
  
  <pre><code>Traceback (most recent call last):
  
    File "C:/Users/vaibhav/PycharmProjects/Coding/Coding.py", line 15, in &lt;module&gt;
      print (s.loads(token))
    File "C:\Users\vaibhav\Anaconda\lib\site-packages\itsdangerous.py", line 798, in loads
      self, s, salt, return_header=True)
    File "C:\Users\vaibhav\Anaconda\lib\site-packages\itsdangerous.py", line 752, in loads
      self.make_signer(salt, self.algorithm).unsign(want_bytes(s)),
    File "C:\Users\vaibhav\Anaconda\lib\site-packages\itsdangerous.py", line 377, in unsign
      payload=value)
  itsdangerous.BadSignature: Signature 'Ch8y6BDMIIBdIGM0lmjdAimINvP3PnUmBpOp-jDW18w' does not match
  </code></pre>
  
  <p>If I change the line:</p>
  
  <pre><code>s = TimedJSONWebSignatureSerializer(app.config['SECRET-KEY'], expires_in=3600)
  </code></pre>
  
  <p>to this:</p>
  
  <pre><code>s = TimedJSONWebSignatureSerializer('SECRET-KEY', expires_in=3600)
  </code></pre>
  
  <p>The code works without a problem.</p>
  
  <p>QUETSION : Please tell me why this works as according to <a href="http://flask.pocoo.org/docs/0.11/config/" rel="nofollow noreferrer">Configuration Handling</a>, <code>app.config('SECRET-KEY')</code> returns a secret key as well.</p>
  
  <p><a href="https://i.stack.imgur.com/FYeuZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FYeuZ.png" alt="enter image description here"></a></p>
  
  <p>I referred to this website for learning token authentication:<br></p>
  
  <p><a href="http://blog.miguelgrinberg.com/post/restful-authentication-with-flask" rel="nofollow noreferrer">RESTful Authentication with Flask</a>
  <br> Thanks in advance!</p>