title: Azure AD-B2C error: IDX10501: Signature validation failed. Unable to match keys: kid: '[PII is hidden]', token: '[PII is hidden]'
body: <p>I’m using Swagger to make API calls, for authentication I’m able to generate Bearer token but after that I' m getting 401 in response. After checking logs, below is the error:</p>
  <pre><code>Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys: 
  kid: '[PII is hidden]', 
  token: '[PII is hidden]'
  </code></pre>
  <p>My ConfigureAuth method is as below:</p>
  <pre class="lang-cs prettyprint-override"><code>private static void ConfigureAuth(IAppBuilder app)
  {
      var metadataEndpoint = string.Format(
          configProvider.GetConfigValue&lt;string&gt;(&quot;ida:AadInstance&quot;, &quot;AuthConfig&quot;),
          configProvider.GetConfigValue&lt;string&gt;(&quot;ida:Tenant&quot;, &quot;AuthConfig&quot;),
          configProvider.GetConfigValue&lt;string&gt;(&quot;ida:SignInPolicy&quot;, &quot;AuthConfig&quot;));
  
      string[] validAudiences = configProvider.GetConfigValue&lt;string&gt;(&quot;ida:Audiences&quot;, &quot;AuthConfig&quot;).Split(',');
      TokenValidationParameters tvps = new TokenValidationParameters
      {
          ValidAudiences = validAudiences,
          AuthenticationType = configProvider.GetConfigValue&lt;string&gt;(&quot;ida:SignInPolicy&quot;, &quot;AuthConfig&quot;),
          ValidateAudience = true,
          ValidateIssuer = configProvider.GetConfigValue&lt;bool&gt;(&quot;validateIssuer&quot;, &quot;AuthConfig&quot;),
          ValidateLifetime = true,
          ValidAudience = configProvider.GetConfigValue&lt;string&gt;(&quot;Swagger:ClientId&quot;, &quot;AuthConfig&quot;),
          //NameClaimType = &quot;http://schemas.microsoft.com/identity/claims/objectidentifier&quot;,
      };
  
      //SecurityToken securityToken;
      //JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
      app.UseOAuthBearerAuthentication(
          new OAuthBearerAuthenticationOptions
           {
              AccessTokenFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(metadataEndpoint)),
              Provider = new OAuthBearerAuthenticationProvider()
              {
                  OnRequestToken = (context) =&gt;
                  {
                      if (!string.IsNullOrEmpty(context.Token))
                      {
                      }
  
                      return Task.FromResult&lt;int&gt;(0);
                  },
                  OnValidateIdentity = (context) =&gt;
                      {
                          ////TO DO
                          //// Steps to perform after identity validation
  
                          return Task.FromResult&lt;int&gt;(0);
                      }
              }
          });
  }
  </code></pre>