title: Validate JWT in Azure APIM policy
body: <p>In Azure APIM, I am trying to create a policy that will validate a JWT. No matter what I try, I always get a &quot;401: Invalid JWT&quot; error.  Does anyone know what I'm doing wrong?  (Maybe I'm not using the right signing key?)</p>
  <p>My base64 encoded security key is <code>Zm9v</code>.</p>
  <p>I create sample token at jwt.io and so my Authorization header is:</p>
  <pre><code>Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.Bm8tu4m18oA96xwhBL8AV_4hRpIU6OrK5UaOmGqBEsk
  </code></pre>
  <p>Here's the policy I am using:</p>
  <pre><code>&lt;policies&gt;
      &lt;inbound&gt;
          &lt;base /&gt;
          &lt;validate-jwt
              header-name=&quot;Authorization&quot;
              require-expiration-time=&quot;false&quot;
              require-scheme=&quot;Bearer&quot;
          &gt;
              &lt;issuer-signing-keys&gt;
                  &lt;key&gt;Zm9v&lt;/key&gt;
              &lt;/issuer-signing-keys&gt;
          &lt;/validate-jwt&gt;
      &lt;/inbound&gt;
      &lt;backend&gt;
          &lt;base /&gt;
      &lt;/backend&gt;
      &lt;outbound&gt;
          &lt;base /&gt;
      &lt;/outbound&gt;
      &lt;on-error&gt;
          &lt;base /&gt;
      &lt;/on-error&gt;
  &lt;/policies&gt;
  </code></pre>
  <p>HTTP Response:</p>
  <pre><code>cache-control: private
  content-length: 48
  content-type: application/json
  ocp-apim-trace-location: https://xxxxxxx
  vary: Origin
  {
      &quot;statusCode&quot;: 401,
      &quot;message&quot;: &quot;Invalid JWT.&quot;
  }
  </code></pre>