# jose.exceptions.JWSSignatureError: Signature verification failed

- **ID:** `python/fastapi-jwt-decode-invalid-signature`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

JWT was signed with a different secret/key than the one used to verify, or the algorithm was mismatched.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |
| 5.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
   ```
2. **** (93% success)
   ```
   SECRET_KEY = os.environ['JWT_SECRET']  # same in issuer and verifier
   ```

## Dead Ends

- **** — Disables auth entirely; severe security hole. (99% fail)
- **** — Accepts invalid tokens; security bypass. (98% fail)