IDX10503: Signature validation failed. The token's kid is: '2026-10', but did not match any keys in TokenValidationParameters or Configuration.

The full text continues with "Keys tried: …", key counts and `[PII of type … is hidden]` placeholders (set `IdentityModelEventSource.ShowPII = true` in development to see them). Checked on 6.36.0, 7.7.1 and 8.23.0: 6.x words it "IDX10503: Signature validation failed. Token does not have a kid. Keys tried: …"; 7.x and 8.x use the wording above, and report a token without `kid` as IDX10517 "The token's kid is missing".

Microsoft.IdentityModel.JsonWebTokens / System.IdentityModel.Tokens.Jwt (.NET) — SecurityTokenSignatureKeyNotFoundException

What it means

The token names its signing key with a `kid`, and no key in `TokenValidationParameters` (`IssuerSigningKey(s)`) or in the configuration downloaded from the authority's JWKS has that key ID. The signature was never computed — there was no candidate key. In ASP.NET Core the client sees `WWW-Authenticate: Bearer error="invalid_token", error_description="The signature key was not found"`.

Why it happens

• The issuer rotated its signing key

  common

  A key configured statically (or a cached configuration that never refreshed) knows only the previous `kid`. Entra ID, Auth0, Keycloak and IdentityServer all rotate keys.

• Authority or metadata address of another tenant

  common

  Entra ID v1 vs v2 endpoints, a different tenant ID, B2C policies with separate metadata, or a staging authority. The downloaded keys are valid — for someone else's tokens.

• The configuration could not be loaded

  occasional

  When the metadata download fails, the handler validates with zero configuration keys ("Number of keys in Configuration: '0'"). The real error (IDX20803) is logged separately.

• A single IssuerSigningKey for a multi-key issuer

  occasional

  Hard-coding one key from the JWKS works until the issuer signs with another key in the set.

How to fix it

1. 1.

   Let the handler fetch keys from the authority

   With `Authority` set, `JwtBearer` downloads the issuer's JWKS through OpenID Connect discovery, refreshes it periodically and also when a token names an unknown key (`RefreshOnIssuerKeyNotFound`, on by default).

   builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
       .AddJwtBearer(options =>
       {
           // Keys come from {Authority}/.well-known/openid-configuration -> jwks_uri and are refreshed automatically.
           options.Authority = "https://login.example.com/";
           options.Audience = "api://orders";
       });

2. 2.

   Reveal the hidden values while debugging

   IdentityModel hides key IDs and token contents in exception text by default. Enable `ShowPII` only in development to see which keys were tried.

   // Development only: show the hidden values ([PII of type ... is hidden]) in IDX messages.
   if (builder.Environment.IsDevelopment())
   {
       Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
   }

← Browse the full signature error database