The token is not yet valid (iat)

The claim in parentheses is `iat` or `nbf`. PyJWT 2.0–2.5 accepted an `iat` in the future; 2.6.0 started rejecting it, so an upgrade from an old version can surface clock skew that existed all along.

PyJWT (Python) — jwt.exceptions.ImmatureSignatureError

What it means

PyJWT's `ImmatureSignatureError`: the token's `iat` (issued at) or `nbf` (not before) is later than the verifier's current time. The name in parentheses tells you which claim. PyJWT rejects tokens issued "in the future" because a correct issuer cannot produce one; in practice this almost always means the issuer's clock is ahead of yours.

Why it happens

• The issuer's clock is ahead

  common

  Tokens minted on a host whose clock runs a few seconds fast fail on every verifier with a correct clock until that many seconds pass. It looks intermittent because most requests arrive later than the skew.

• The issuer set a future nbf

  occasional

  Tokens that become valid later (scheduled access, delayed activation) are rejected until `nbf`. That is the intended behavior.

• Timestamps in milliseconds

  rare

  JWT times are seconds. An issuer that writes `time.time() * 1000` or JavaScript's `Date.now()` produces tokens valid only tens of thousands of years from now.

How to fix it

1. 1.

   Allow a small leeway

   `leeway` (seconds or a `timedelta`) tolerates clock differences for `exp`, `nbf` and `iat`. Keep it to tens of seconds, and fix the drifting clock with NTP.

   from datetime import timedelta
   
   claims = jwt.decode(
       token,
       signing_key,
       algorithms=["ES256"],
       audience="https://api.example.com",
       leeway=timedelta(seconds=30),  # applies to exp, nbf and iat
   )

2. 2.

   Measure the skew

   Print each time claim relative to the local clock. A small positive `iat` means skew; a huge one means a unit bug in the issuer.

   import time
   
   c = jwt.decode(token, options={"verify_signature": False})
   now = int(time.time())
   print({k: c[k] - now for k in ("iat", "nbf", "exp") if k in c})  # seconds relative to this host

← Browse the full signature error database