# 401 Unauthorized: JWT claims validation failed

- **ID:** `api/jwt-claims-validation-failed`
- **Domain:** api
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The JWT token's claims (e.g., audience, issuer, or expiration) do not match the server's expected values, often due to clock skew or misconfiguration.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| spring-security 6.2.0 | active | — | — |
| express-jwt 8.4.0 | active | — | — |
| PyJWT 2.8.0 | active | — | — |
| jsonwebtoken 9.0.0 | active | — | — |

## Workarounds

1. **Synchronize server and client clocks using NTP, then retry the request. For example, on Linux: `sudo ntpdate pool.ntp.org` or enable `systemd-timesyncd`.** (75% success)
   ```
   Synchronize server and client clocks using NTP, then retry the request. For example, on Linux: `sudo ntpdate pool.ntp.org` or enable `systemd-timesyncd`.
   ```
2. **In the server configuration, set a leeway for clock skew (e.g., 30 seconds). For express-jwt: `app.use(jwt({ secret: 'mysecret', clockTolerance: 30 }))`.** (85% success)
   ```
   In the server configuration, set a leeway for clock skew (e.g., 30 seconds). For express-jwt: `app.use(jwt({ secret: 'mysecret', clockTolerance: 30 }))`.
   ```
3. **Verify that the 'aud' (audience) and 'iss' (issuer) claims in the token match the server's expected values. Update the token generation code or server configuration accordingly.** (90% success)
   ```
   Verify that the 'aud' (audience) and 'iss' (issuer) claims in the token match the server's expected values. Update the token generation code or server configuration accordingly.
   ```

## Dead Ends

- **** — Token regeneration does not fix clock skew or misconfigured audience/issuer values; the new token will still be rejected. (70% fail)
- **** — Disabling validation exposes the API to unauthorized access and token forgery. (90% fail)
- **** — Changing the payload invalidates the signature, leading to a signature verification failure. (80% fail)