Significant-Gravitas/AutoGPT · error · ValueError

Invalid token: symmetric tokens are not accepted

Error message

Invalid token: symmetric tokens are not accepted

What it means

Error "Invalid token: symmetric tokens are not accepted" thrown in Significant-Gravitas/AutoGPT.

Source

Thrown at autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py:103

    valid during a migration window.

    :param token: The token to parse
    :param audience: The `aud` claim the token must carry. Defaults to the
        user-token audience; service tokens use a distinct audience so the
        two planes can't be replayed against each other.
    :return: The decoded payload
    :raises ValueError: If the token is invalid or expired
    """
    settings = get_settings()
    try:
        header = jwt.get_unverified_header(token)
    except jwt.InvalidTokenError as e:
        raise ValueError(f"Invalid token: {str(e)}") from e

    algorithm = header.get("alg", "")
    if algorithm.startswith("HS"):
        if not settings.JWT_VERIFY_KEY:
            raise ValueError("Invalid token: symmetric tokens are not accepted")
        key = settings.JWT_VERIFY_KEY
        algorithms = [settings.JWT_ALGORITHM]
    else:
        if not settings.JWT_JWKS_URL:
            raise ValueError("Invalid token: asymmetric tokens are not accepted")
        try:
            key = _get_jwks_client().get_signing_key_from_jwt(token).key
            algorithms = settings.JWT_JWKS_ALGORITHMS
        except jwt.PyJWKClientError as e:
            # The legacy verifier supported — and its config text recommended —
            # asymmetric algorithms, with the public key in JWT_VERIFY_KEY. A
            # token whose kid isn't in the Better Auth JWK set can therefore
            # still be a live legacy session from that configuration, so the
            # migration-window grace extends here too: fall back to the shared
            # legacy key when it's configured for a matching asymmetric alg.
            if (
                settings.JWT_VERIFY_KEY
                and not settings.JWT_ALGORITHM.startswith("HS")

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Use an asymmetric (RS256/ES256) signed token; HS256 symmetric tokens are rejected by this verifier.
2. Check the token issuer configuration so it signs with the expected asymmetric algorithm.

When it happens

Trigger: Thrown at autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/8eddb222187ca686. Report an issue: GitHub.