Pumpkin-MC/Pumpkin · error · AuthError

Token not signed by trusted Mojang key

Error message

Token not signed by trusted Mojang key

What it means

This error means a JWT presented by a client was cryptographically valid or parseable, but the public key it carries (or is signed with) does not match the trusted Mojang public key. The library refuses to accept tokens whose signing key differs from Mojang's, since such tokens cannot be trusted to authenticate a player's identity.

Solutions

1. Reject the player's authentication attempt; this error is by design and not recoverable
2. Check that the client is a genuine, unmodified Minecraft client connecting with a real Mojang account
3. Ensure no proxy or intermediary is altering the token's key header in transit
4. If testing locally, use legitimate session tokens rather than hand-crafted JWTs

Example fix

// before
match jwt::verify(&token) {
    Err(jwt::Error::MojangKeyMismatch) => {},
    other => other?,
}
// after
jwt::verify(&token)?; // key mismatch => disconnect client with 'invalid public key'

match jwt::verify(&token) {
    Err(jwt::Error::MojangKeyMismatch) => {
        // disconnect player: token is not signed by the trusted Mojang key
    }
    r => r?,
}

When it happens

Trigger: Verifying a player's chat/session/profile token where the embedded x5u key or the signature verification key comparison against the hardcoded Mojang public key fails.

Common situations: Modified clients or third-party launchers forging tokens; man-in-the-middle/proxy tampering with tokens; attempting offline-mode players against a server that enforces Mojang-signed keys.

Related errors

• Invalid signature
• Invalid token format
• x5u not found in header
• JSON parse error
• Public key build failed

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/4cde3653d9c193e5. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-auth/src/jwt/mod.rs:48

#[derive(Debug, Error)]
pub enum AuthError {
    /// Indicates that a JWT token has an invalid format (not enough parts).
    #[error("Invalid token format")]
    InvalidTokenFormat,
    /// Indicates that the 'x5u' (X.509 URL) header parameter is missing from a token.
    #[error("x5u not found in header")]
    MissingX5U,
    /// Indicates a failure in Base64 decoding.
    #[error("Base64 decoding failed: {0}")]
    Base64Decode(#[from] base64::DecodeError),
    /// Indicates a failure in parsing JSON data.
    #[error("JSON parse error: {0}")]
    JsonParse(#[from] serde_json::Error),
    /// Indicates a failure in building a public key from its representation.
    #[error("Public key build failed: {0}")]
    PublicKeyBuild(String),
    /// Indicates that the token was not signed by the trusted Mojang public key.
    #[error("Token not signed by trusted Mojang key")]
    MojangKeyMismatch,
    /// Indicates that the token's signature is invalid.
    #[error("Invalid signature")]
    InvalidSignature,
    /// Indicates an error related to ECDSA signature operations.
    #[error("ECDSA signature error: {0}")]
    Ecdsa(#[from] ecdsa::Error),
}

/// Decodes a Base64 URL-safe encoded string with no padding.
///
/// # Arguments
///
/// * `s` - The Base64 URL-safe encoded string to decode.
///
/// # Returns
///
/// A `Result` containing the decoded bytes or a `base64::DecodeError`.

View on GitHub (pinned to 8d4639e25a)