title: IDX10501: Signature validation failed. Unable to match keys
body: <p>Please help me to understand the difference between JWT token validation from the ASP netcore application and the netcore Kestrel hosted application.</p>
  
  <p>There are two applications that verifies token using the source code like below:</p>
  
  <pre><code>public static IServiceCollection AddJwtToken(this IServiceCollection services, OAuthConfig config)
  {
      services.AddMvc();
      services.AddAuthorization();
  
      Logger.DebugFormat("AddJwtBearer authority:{0} audience:{1}", config.GetAuthority(), config.Resource);
  
      services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
          .AddJwtBearer(options =&gt; new JwtBearerOptions
          {
              Authority = config.GetAuthority(),
              Audience = config.Resource,
      });
  
      return services;
  }
  </code></pre>
  
  <p>it is pretty simple and it works well if token is being validated from the asp net core 2.2 application</p>
  
  <pre><code>// in the asp.net core
  var builder = WebHost.CreateDefaultBuilder(args);
  builder
          .UseStartup&lt;Startup&gt;()
          .ConfigureKestrel(_ =&gt; _.ConfigureEndpoints())
          .UseSerilog();
  </code></pre>
  
  <p>And there is another application (console) that starts the same rest service host using the <code>UseKestrel</code></p>
  
  <pre><code>//in the console app
  var builder = WebHost.CreateDefaultBuilder()
      .UseNLog()
      .UseKestrel(_ =&gt; _.ConfigureEndpoints())
      .UseStartup&lt;Startup&gt;();
  </code></pre>
  
  <p>the only one significant difference is that there is <code>UseKestrel</code> in the console via <code>ConfigureKestrel</code> for asp.net core.</p>
  
  <p>The same source code (and configuration) is used to get token from the Azure AD. 
  Please find it as <a href="https://gist.github.com/oleksabor/a4c873e078f74086ddda57b6b29f2c74" rel="noreferrer">the gist here</a>. 
  It is configured to get token from the <code>https://login.microsoftonline.com/{tenant}/v2.0</code> provider. The same token endpoint, clientid, secret and scope values are used for both cases.</p>
  
  <p>The problem is that <code>AddJwtBearer</code> validates the token in the asp.net core and does not in the console app. 
  the error is </p>
  
  <pre><code>Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys:
  kid: 'BB8CeFVqyaGrGNuehJIiL4dfjzw',
  token: '{"typ":"JWT","alg":"RS256","kid":"BB8CeFVqyaGrGNuehJIiL4dfjzw"}.{"aud":"2c163c99-935b-4362-ae0d-657f589f5565","iss":"https://login.microsoftonline.com/{tenantidhere}/v2.0
  </code></pre>
  
  <p>Why asp.net core host validates the token (for the first <code>AddJwtBearer</code> implementation) and console host fails?</p>
  
  <p>Thank you</p>