JWT Invalid Signature Error

Ensure the secret used for verification matches the one used for signing.

// ❌ Different secrets
const secret = "my-secret-key"
const token = jwt.sign({ id: 1 }, "wrong-secret") // Signed with different secret
jwt.verify(token, secret) // Throws: invalid signature

// ✅ Same secret
const token = jwt.sign({ id: 1 }, secret)
jwt.verify(token, secret) // Passes

When rotating secrets, keep the old secret valid for a transition period.

const secrets = [
  { key: process.env.JWT_SECRET_NEW, active: true },
  { key: process.env.JWT_SECRET_OLD, active: false },
]

function verifyToken(token) {
  for (const { key } of secrets) {
    try { return jwt.verify(token, key) }
    catch (e) { continue }
  }
  throw new Error("Invalid token with all keys")
}

Always specify the allowed algorithms when verifying to prevent 'none' algorithm attacks.

// Explicitly set allowed algorithms
jwt.verify(token, secret, {
  algorithms: ["HS256"] // Only allow HMAC-SHA256
})

// ❌ Never do this
jwt.verify(token, secret) // Implicit algorithm may allow "none"