{"record":{"id":"888b5aeb0e56f320","repo":"thephpleague/oauth2-server","slug":"access-token-is-not-an-instance-of-unencryptedtoken","errorCode":null,"errorMessage":"Access token is not an instance of UnencryptedToken","messagePattern":"Access token is not an instance of UnencryptedToken","errorType":"http","errorClass":"OAuthServerException","httpStatus":401,"severity":"error","filePath":"src/AuthorizationValidators/BearerTokenValidator.php","lineNumber":125,"sourceCode":"        }\n\n        try {\n            // Attempt to parse the JWT\n            $token = $this->jwtConfiguration->parser()->parse($jwt);\n        } catch (Exception $exception) {\n            throw OAuthServerException::accessDenied($exception->getMessage(), null, $exception);\n        }\n\n        try {\n            // Attempt to validate the JWT\n            $constraints = $this->jwtConfiguration->validationConstraints();\n            $this->jwtConfiguration->validator()->assert($token, ...$constraints);\n        } catch (RequiredConstraintsViolated $exception) {\n            throw OAuthServerException::accessDenied('Access token could not be verified', null, $exception);\n        }\n\n        if (!$token instanceof UnencryptedToken) {\n            throw OAuthServerException::accessDenied('Access token is not an instance of UnencryptedToken');\n        }\n\n        $claims = $token->claims();\n\n        // Check if token has been revoked\n        if ($this->accessTokenRepository->isAccessTokenRevoked($claims->get('jti'))) {\n            throw OAuthServerException::accessDenied('Access token has been revoked');\n        }\n\n        // Return the request with additional attributes\n        return $request\n            ->withAttribute('oauth_access_token_id', $claims->get('jti'))\n            ->withAttribute('oauth_client_id', $claims->get('aud')[0])\n            ->withAttribute('oauth_user_id', $claims->get('sub'))\n            ->withAttribute('oauth_scopes', $claims->get('scopes'));\n    }\n}\n","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/thephpleague/oauth2-server/blob/9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c/src/AuthorizationValidators/BearerTokenValidator.php#L107-L143","documentation":"Guard inside validateAuthorization(): the string parsed from the Authorization header is a JWE (encrypted token) or otherwise not an UnencryptedToken, so its claims (such as the jti used for revocation checks) cannot be read. This server issues/accepts only signed, unencrypted JWTs, so an encrypted or opaque token presented as a bearer credential is rejected.","triggerScenarios":"Client sends an encrypted token or a non-JWT opaque string that the parser accepted (e.g. a signed JWE, or a token type from a different library).","commonSituations":"Issuer uses JWE encryption while validator expects unencrypted JWS; client sends an ID token/session cookie instead of an access token.","solutions":["Send the standard (unencrypted JWS) access token issued by league/oauth2-server.","Ensure the issuer doesn't encrypt tokens (JWE); use signed-only JWTs.","Confirm the client isn't sending an ID token or refresh token in the Authorization header."],"exampleFix":"// before\n$request = $request->withHeader('Authorization', 'Bearer ' . $idToken);\n// after\n$request = $request->withHeader('Authorization', 'Bearer ' . $accessToken);","handlingStrategy":"type-guard","validationCode":"$jwt = substr($header, 7);\nif (substr_count($jwt, '.') !== 2) throw new \\RuntimeException('Not a JWS access token');","typeGuard":"function isUnencryptedJwt(string $token): bool { $p = explode('.', $token); return count($p) === 3 && $p[0] !== '' && $p[2] !== ''; }","tryCatchPattern":"try { $request = $validator->validateAuthorization($request); } catch (OAuthServerException $e) { return $e->generateHttpResponse(new Response(), 401); }","preventionTips":["Send the access token, never the ID token","Disable JWE token encryption in the issuer","Document that only opaque-3-part JWTs are accepted"],"tags":["oauth","jwt","token-type"],"backgroundTag":"type-mismatch","analyzedSha":"9d2f6fc0a0b5aa1bb02506971d3a4ecff2c6526c","analyzedAt":"2026-09-15T22:33:30.452Z","contentChangedAt":"2026-09-15T22:33:30.452Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}