alibaba/nacos · error · AccessException

token invalid!

Error message

token invalid!

What it means

Thrown by NacosSignatureAlgorithm.verify() as an AccessException when the JWT string does not split into exactly three dot-separated parts (header.payload.signature). Any token that is not structurally a compact JWT is rejected before algorithm selection.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/jwt/NacosSignatureAlgorithm.java:103

        MAP.put(HS384_JWT_HEADER, HS384);
        MAP.put(HS512_JWT_HEADER, HS512);
    }
    
    /**
     * verify jwt.
     *
     * @param jwt complete jwt string
     * @param key for signature
     * @return object for payload
     * @throws AccessException access exception
     */
    public static NacosUser verify(String jwt, Key key) throws AccessException {
        if (StringUtils.isBlank(jwt)) {
            throw new AccessException("user not found!");
        }
        String[] split = jwt.split("\\.");
        if (split.length != JWT_PARTS) {
            throw new AccessException("token invalid!");
        }
        String header = split[HEADER_POSITION];
        String payload = split[PAYLOAD_POSITION];
        String signature = split[SIGNATURE_POSITION];
        
        NacosSignatureAlgorithm signatureAlgorithm = MAP.get(header);
        if (signatureAlgorithm == null) {
            throw new AccessException("unsupported signature algorithm");
        }
        NacosUser user = signatureAlgorithm.verify(header, payload, signature, key);
        user.setToken(jwt);
        return user;
    }
    
    /**
     * verify jwt.
     *
     * @param header    header of jwt

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Ensure the value passed to verify() is a complete three-part compact JWT.
2. Log jwt.split(".").length during debugging to confirm the part count.
3. Regenerate/re-issue the token if it was corrupted in transit.

Example fix

// before
String jwt = "abc123"; // opaque, not a JWT -> error 1276
NacosSignatureAlgorithm.verify(jwt, key);

// after
String jwt = loginResponse.getAccessToken(); // proper ey...eyJ...sig JWT
NacosSignatureAlgorithm.verify(jwt, key);

if (jwt == null || jwt.split("\\.").length != 3) {
    throw new AccessException("token invalid!");
}
NacosSignatureAlgorithm.verify(jwt, key);

try {
    NacosSignatureAlgorithm.verify(jwt, key);
} catch (AccessException e) {
    if ("token invalid!".equals(e.getMessage())) {
        // not a compact JWT — prompt re-login
    }
    throw e;
}

When it happens

Trigger: jwt.split("\\.").length != 3 — the token has too few or too many dots; e.g., a plain opaque token, a JSON string, a token with an extra trailing dot, or a truncated token.

Common situations: Passing an opaque session id instead of a JWT; a token truncated by a header-length limit or copy-paste; a token with embedded base64 content containing an unexpected dot count after corruption.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• invalid token, username is empty
• the length of secret key must great than or equal 32 bytes;
• user not found!
• token expired!
• Nacos auth plugin has not been initialized

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/601880de4328c3df. Report an issue: GitHub.