title: ASP.NET Core authentication with JWT: 'The signature is invalid'
body: <p>I want to enable authentication based on jwt claims. For some reason the token seems to be invalid, more specifically its signature seems to be the problem.</p>
  
  <p>I tried verifying the signature on <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a> and it is verified successfully. </p>
  
  <p>My token is</p>
  
  <blockquote>
    <p>eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZ2VudCIsImF1dCI6WyJST0xFX0FHRU5UIl0sImlzcyI6Ik1ULVVzZXIiLCJpYXQiOjE1NjA2OTcyMDIsImV4cCI6MTU2MDY5ODEwMn0.WDTPFuEsRRuDfko2dR_5QsWWmyEwUtup-C-V3AF0tE95SJWuNtTiWQCcGoHsNdi-Y7G62pNv4TpaQ3h-deGR3A</p>
  </blockquote>
  
  <p>And the secret is</p>
  
  <blockquote>
    <p>9ST5hQe5dUNfAJOQZAtt19uiDhNtKKUt</p>
  </blockquote>
  
  <p>My Startup.cs class:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services) 
  {
  
              /*...*/
  
              var key = Encoding.ASCII.GetBytes("9ST5hQe5dUNfAJOQZAtt19uiDhNtKKUt");
              var signingKey = new SymmetricSecurityKey(key);
  
              // Authenticate a request 
              services.AddAuthentication(x =&gt;
              {
                  x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                  x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
              })
              .AddJwtBearer(x =&gt;
              {
                  x.RequireHttpsMetadata = false;
                  x.SaveToken = true;
                  x.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateIssuerSigningKey = true,
                      IssuerSigningKey = signingKey,
                      ValidateAudience = false,
                      ValidateIssuer = false
                  };
              });
              // Custom policy to check if a certain claim has a certain value
              services.AddAuthorization(options =&gt;
              {
                  options.AddPolicy(
                      "IsAgentPolicy",
                      policy =&gt; policy.RequireClaim("aut", "ROLE_AGENT")
                  );
              });
  
              /*...*/
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
  
              app.UseAuthentication();
  
              app.UseMvc();
          }
  </code></pre>
  
  <p>My test api controller ValuesController.cs:</p>
  
  <pre><code>    [Route("api/[controller]")]
      public class ValuesController : ControllerBase
      {
          // GET: api/&lt;controller&gt;
          [HttpGet]
          public IEnumerable&lt;string&gt; Get()
          {
              return new string[] { "value1", "value2" };
          }
  
          // GET api/&lt;controller&gt;/5
          [HttpGet("{id}")]
          [Authorize("IsAgentPolicy")]
          public string Get(int id)
          {
              return "value";
          }
      }
  </code></pre>
  
  <p>I tried to hit the 'localhost:5000/api/values/1' endpoint (which has an authorization attribute), adding the 'Bearer ' to the 'Authorization' header, however I get a response header</p>
  
  <blockquote>
    <p>WWW-Authenticate →Bearer error="invalid_token", error_description="The signature is invalid"</p>
  </blockquote>
  
  <hr>