# JWT Plugin: Invalid Signature

**URL:** <https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688>\
**Category:** General\
**Created:** [March 2, 2020, 2:17pm UTC](https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688 "2020-03-02T14:17:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kinihun](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/kinihun/32/2066_2.png) [@kinihun](https://discuss.konghq.com/u/kinihun)\
**Post date:** [March 2, 2020, 2:17pm UTC](https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688/1 "2020-03-02T14:17:25Z")

</div>

Hi Folks,  
First question from a a first time user of Kong.  
**Setup:**

- Kong deployed using Helm running as Ingress Controller in Kubernetes
- JWT KongPlugin resource used to validate Okta Authorisation code per namespace
- KongConsumer deployed per namespace
- KongCredential deployed per namespace mapped to KongConsumer and configured to use RS256, Key and RSA Public Key supplied.

**Problem**

- OKTA authentication is successful
- JWT validation fails as “Invalid Signature”

I have tried using HS256 as the algorithm without success.  
I have also tried using Kubernetes Secret instead of KongCredential which is deprecated.  
As I am using community version JWKS is not an option, no supported Plugin but then I have the correct Public Key configured.

Help much appreciated.

---

<div class="post-metadata">

**Author:** ![Agustin\_Daguerre](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/agustin_daguerre/32/1769_2.png) [@Agustin\_Daguerre](https://discuss.konghq.com/u/Agustin_Daguerre)\
**Post date:** [March 9, 2020, 8:50pm UTC](https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688/2 "2020-03-09T20:50:04Z")

</div>

Hey,

I’m in a similar situation I think. How did you set the algorithm of the credential to RS256 when creating the kubernetes secret? I’m trying to use this as KongCredential is deprecated.

Are you setting the plugin, consumer, etc through the declarative config file or through yaml manifests? Could you share your config?

Thanks!

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [March 10, 2020, 4:27am UTC](https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688/3 "2020-03-10T04:27:52Z")

</div>

What did you try? You generally need to set the keys using the following flags when creating the secret:

```auto
--from-literal=algorithm=foo --from-literal=another-key=another-value

```

---

<div class="post-metadata">

**Author:** ![Agustin\_Daguerre](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/agustin_daguerre/32/1769_2.png) [@Agustin\_Daguerre](https://discuss.konghq.com/u/Agustin_Daguerre)\
**Post date:** [March 10, 2020, 1:19pm UTC](https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688/4 "2020-03-10T13:19:21Z")

</div>

My issue was with a validation of the rsa key with RS256. I could fixed it provided the correct key format. Thanks for the reply!

---

<div class="post-metadata">

**Author:** ![arielhernandezmusa](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@arielhernandezmusa](https://discuss.konghq.com/u/arielhernandezmusa)\
**Post date:** [June 27, 2020, 10:24pm UTC](https://discuss.konghq.com/t/jwt-plugin-invalid-signature/5688/5 "2020-06-27T22:24:11Z")

</div>

Hi, I have same issue using HS256

this is my secret

apiVersion: v1  
kind: Secret  
metadata:  
name: app-jwt  
type: Opaque  
stringData:  
kongCredType: jwt  
key: auth  
algorithm: HS256  
secret: pleaseChangeThisSecretForANewOne