{"record":{"id":"615afe41020638da","repo":"lcobucci/jwt","slug":"the-token-cannot-be-used-yet","errorCode":null,"errorMessage":"The token cannot be used yet","messagePattern":"The token cannot be used yet","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/LooseValidAt.php","lineNumber":56,"sourceCode":"\n        $this->assertIssueTime($token, $now->add($this->leeway));\n        $this->assertMinimumTime($token, $now->add($this->leeway));\n        $this->assertExpiration($token, $now->sub($this->leeway));\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertExpiration(Token $token, DateTimeInterface $now): void\n    {\n        if ($token->isExpired($now)) {\n            throw ConstraintViolation::error('The token is expired', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertMinimumTime(Token $token, DateTimeInterface $now): void\n    {\n        if (! $token->isMinimumTimeBefore($now)) {\n            throw ConstraintViolation::error('The token cannot be used yet', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertIssueTime(Token $token, DateTimeInterface $now): void\n    {\n        if (! $token->hasBeenIssuedBefore($now)) {\n            throw ConstraintViolation::error('The token was issued in the future', $this);\n        }\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":68,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/LooseValidAt.php#L38-L68","documentation":"This ConstraintViolation is thrown by the LooseValidAt constraint when the token's `nbf` (not before) claim is in the future relative to the current time (adjusted by leeway). The library rejects tokens used before the start of their validity window.","triggerScenarios":"LooseValidAt::assert($token) calls assertMinimumTime(), which throws when Token::isMinimumTimeBefore($now) returns false — i.e. the token carries an `nbf` claim later than ($now + leeway).","commonSituations":"Pre-issued tokens (e.g. scheduled jobs, invites, licenses) used before their `nbf` timestamp; validating a token seconds after issuance on a server whose clock lags behind the issuer's; issuing systems setting `nbf` too aggressively (future-dated) by mistake.","solutions":["Wait until the token's `nbf` time has passed, or request a token whose `nbf` is now or in the past.","Add leeway: new LooseValidAt($clock, DateInterval::createFromDateString('30 seconds')) to tolerate small clock skew.","Fix the issuer to not set `nbf` in the future unless intentionally scheduling (->cannotBeUsedBefore(...) only when needed).","Compare $token->claims()->get('nbf') with your server time (NTP-synced) to determine whether clock skew is the cause."],"exampleFix":"// before: token with future nbf rejected immediately\n$validator->assert($token, [new LooseValidAt($clock)]); // 'cannot be used yet'\n\n// after: tolerate 30s skew / near-future nbf\n$validator->assert($token, [\n    new LooseValidAt($clock, DateInterval::createFromDateString('30 seconds')),\n]);","handlingStrategy":"try-catch","validationCode":"$nbf = $token->claims()->get('nbf');\nif ($nbf instanceof DateTimeInterface && $nbf->getTimestamp() > time() + $leewaySeconds) {\n    // token not usable yet: delay or reject\n}","typeGuard":"function isPastMinimumTime(Lcobucci\\JWT\\Token $token, int $leewaySeconds = 0): bool\n{\n    $nbf = $token->claims()->get('nbf');\n    return ! $nbf instanceof DateTimeInterface\n        || $nbf->getTimestamp() <= time() + $leewaySeconds;\n}","tryCatchPattern":"try {\n    $validator->assert($token, $constraints);\n} catch (Lcobucci\\JWT\\Validation\\ConstraintViolation $e) {\n    if ($e->getConstraint() instanceof Lcobucci\\JWT\\Validation\\Constraint\\LooseValidAt) {\n        // token not valid yet: schedule retry at nbf time\n    }\n}","preventionTips":["Only set ->cannotBeUsedBefore() when you intentionally schedule future validity.","NTP-sync issuer and verifier clocks.","Use a small leeway in LooseValidAt to absorb second-level skew.","When pre-issuing tokens, deliver them to consumers only at/after the nbf time."],"tags":["jwt","not-before","validation-constraint"],"backgroundTag":"schema-validation-failed","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}