jwt not active

jsonwebtoken (Node.js) — NotBeforeError from jwt.verify()

What it means

jsonwebtoken's `NotBeforeError`: the token has an `nbf` (not before) claim that is later than the verifier's current time, so the token is not valid yet. The error's `date` property holds the moment the token becomes valid. The signature was already checked and is fine.

Why it happens

• The verifier's clock is behind the issuer's

  common

  Issuers commonly set `nbf` to the issue time. If the verifying machine's clock is behind by a few seconds or minutes, freshly issued tokens fail until the clocks catch up — which looks like an intermittent failure right after login.

• The token was signed with a notBefore delay

  occasional

  `jwt.sign(payload, key, { notBefore: "5m" })` deliberately issues a token that becomes valid later. Using it earlier is a correct rejection.

• nbf in milliseconds

  rare

  NumericDate is seconds since the epoch. A hand-built payload with `nbf: Date.now()` is valid only in the far future.

How to fix it

1. 1.

   Allow a small clock skew

   `clockTolerance` (in seconds) is applied to both `nbf` and `exp`. Keep it to a minute or less and fix real drift with NTP on both machines.

   jwt.verify(token, publicKey, {
     algorithms: ["ES256"],
     clockTolerance: 30, // seconds; applies to nbf and exp
   });

2. 2.

   Measure how early the token is

   Compare `err.date` with the verifier's clock. Seconds mean skew; exactly the `notBefore` delay means the token is used too early; thousands of years mean a milliseconds bug.

   try {
     jwt.verify(token, publicKey, { algorithms: ["ES256"] });
   } catch (err) {
     if (err.name === "NotBeforeError") {
       const early = (err.date.getTime() - Date.now()) / 1000;
       console.warn("token becomes valid in", early.toFixed(1), "s");
     }
     throw err;
   }

← Browse the full signature error database