alibaba/nacos · warning · AccessException

Token is not yet valid

Error message

Token is not yet valid

What it means

Thrown by validateClaims when a 'nbf' (not-before) claim is present and is in the future relative to the server clock. The token is considered not yet active.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java:212

    }
    
    /**
     * Perform additional claims validation.
     *
     * @param claims JWT claims
     * @throws AccessException if validation fails
     */
    private void validateClaims(JWTClaimsSet claims) throws AccessException {
        // Validate expiration
        Date expirationTime = claims.getExpirationTime();
        if (expirationTime == null || expirationTime.before(new Date())) {
            throw new AccessException("Token has expired");
        }
        
        // Validate not before (if present)
        Date notBeforeTime = claims.getNotBeforeTime();
        if (notBeforeTime != null && notBeforeTime.after(new Date())) {
            throw new AccessException("Token is not yet valid");
        }
        
        // Validate audience (if client ID is configured)
        String clientId = config.getClientId();
        if (StringUtils.isNotBlank(clientId)) {
            List<String> audience = claims.getAudience();
            if (audience != null && !audience.isEmpty() && !audience.contains(clientId)) {
                // Check if 'azp' (authorized party) matches
                String azp = (String) claims.getClaim("azp");
                if (!clientId.equals(azp)) {
                    String message = String.format(
                        "Token audience mismatch. Expected: %s, Got: %s, azp: %s",
                        clientId, audience, azp);
                    
                    if (config.isStrictAudienceValidation()) {
                        LOGGER.error("{} - Strict validation enabled, rejecting token. "
                            + "This token may be intended for a different client.", message);
                        throw new AccessException("Token audience validation failed");

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Synchronize system clocks (NTP/chrony) on the Nacos host and the IdP.
2. Wait until the token's nbf time has passed, then retry.
3. If skew is unavoidable, request the IdP widen the nbf leeway or omit nbf.
4. Verify the server timezone and time source are correct.

JWTClaimsSet preview = JWTClaimsSet.parse(new String(Base64.getUrlDecoder().decode(token.split("\\.")[1])));
Date nbf = preview.getNotBeforeTime();
if (nbf != null && nbf.after(new Date())) {
    // wait/retry after nbf, or fix clock skew
}

try {
    validator.validate(token);
} catch (AccessException e) {
    if ("Token is not yet valid".equals(e.getMessage())) {
        // likely clock skew; sync NTP, then retry
    }
    throw e;
}

When it happens

Trigger: claims.getNotBeforeTime() != null && notBeforeTime.after(new Date()).

Common situations: Clock skew: the Nacos server's clock is behind the IdP's, so a freshly issued token appears to start in the future; the IdP intentionally sets nbf slightly ahead; containers/VMs with unsynchronized clocks.

Related errors

• Token has expired
• Token audience validation failed
• Token issuer mismatch
• Token is empty
• Invalid token format

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/e5d0197b144f0f29. Report an issue: GitHub.