IDX10511: Signature validation failed. Keys tried:

The rest of the message lists the keys tried (hidden as `[PII … is hidden]` unless `ShowPII` is on), key counts, where the matched key came from and the `kid`.

Microsoft.IdentityModel.JsonWebTokens / System.IdentityModel.Tokens.Jwt (.NET) — SecurityTokenInvalidSignatureException

What it means

Unlike IDX10503, a key with the token's `kid` was found ("Matched key was in 'TokenValidationParameters'" or "…'Configuration'") — and the signature still did not verify with it. Either two different keys share one key ID, or the token was changed after signing. ASP.NET Core answers with `error_description="The signature is invalid"`.

Why it happens

• Two keys with the same kid

  common

  Key IDs chosen by name (`signing-key`, `default`, `rsa1`) collide when each environment or each deployment generates its own key. The validator picks the key by `kid` and the signature fails.

• Header or payload changed after signing

  occasional

  Re-encoding by a gateway, trimming, or test code that edits claims in an existing token.

• Different bytes for the same HMAC secret

  occasional

  With HS256 and a `kid`, one side may build the key from UTF-8 text and the other from base64-decoded bytes. The key ID matches; the key does not.

How to fix it

1. 1.

   Use thumbprint-based key IDs

   A `kid` computed from the key material (RFC 7638) can only collide if the keys are identical.

   // Derive kid from the key itself (RFC 7638 thumbprint) so different keys never share an ID.
   var jwk = JsonWebKeyConverter.ConvertFromECDsaSecurityKey(new ECDsaSecurityKey(ecdsa));
   var key = new ECDsaSecurityKey(ecdsa) { KeyId = Base64UrlEncoder.Encode(jwk.ComputeJwkThumbprint()) };

2. 2.

   Agree on secret bytes

   Store the shared secret base64-encoded and decode it the same way on both sides.

   // HS256: issuer and API must build the key from the same bytes.
   var secret = Convert.FromBase64String(builder.Configuration["Jwt:SecretBase64"]!); // >= 32 bytes
   var signingKey = new SymmetricSecurityKey(secret);

← Browse the full signature error database