# JWT "typ" key missing from Okta token header

**URL:** <https://discuss.konghq.com/t/jwt-typ-key-missing-from-okta-token-header/315>\
**Category:** Questions\
**Created:** [December 28, 2017, 11:11pm UTC](https://discuss.konghq.com/t/jwt-typ-key-missing-from-okta-token-header/315 "2017-12-28T23:11:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zetetic](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/zetetic/32/101_2.png) [@zetetic](https://discuss.konghq.com/u/zetetic)\
**Post date:** [December 28, 2017, 11:11pm UTC](https://discuss.konghq.com/t/jwt-typ-key-missing-from-okta-token-header/315/1 "2017-12-28T23:11:38Z")

</div>

In the documentation for the JWT plugin we see:

```
When creating the signature, make sure that the header is:

{
    "typ": "JWT",
    "alg": "RS256"
}

```

It appears that Okta omits the “typ” key in the headers of its tokens. Is the a problem for Kong? We are trying to track down an issue where Kong rejects Okta tokens with the message “Invalid signature” … could this be the reason?

---

<div class="post-metadata">

**Author:** ![thibaultcha](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/thibaultcha/32/340_2.png) [@thibaultcha](https://discuss.konghq.com/u/thibaultcha)\
**Post date:** [January 2, 2018, 8:57pm UTC](https://discuss.konghq.com/t/jwt-typ-key-missing-from-okta-token-header/315/2 "2018-01-02T20:57:45Z")

</div>

Hi,

The JWT plugin will return [`"invalid typ"`](https://github.com/Kong/kong/blob/master/kong/plugins/jwt/jwt_parser.lua#L133) as an error if the header is invalid. I believe it returns no error if it is missing.

If the token does not include this header, make sure that it is so while creating the signature as well. Otherwise, this error could be caused by a mis-configuration of the plugin (we would need more details to help you through it, but please be careful not to post application secrets and private keys online).