{"record":{"id":"8eddb222187ca686","repo":"Significant-Gravitas/AutoGPT","slug":"invalid-token-symmetric-tokens-are-not-accepted","errorCode":null,"errorMessage":"Invalid token: symmetric tokens are not accepted","messagePattern":"Invalid token: symmetric tokens are not accepted","errorType":"validation","errorClass":"ValueError","httpStatus":401,"severity":"error","filePath":"autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py","lineNumber":103,"sourceCode":"    valid during a migration window.\n\n    :param token: The token to parse\n    :param audience: The `aud` claim the token must carry. Defaults to the\n        user-token audience; service tokens use a distinct audience so the\n        two planes can't be replayed against each other.\n    :return: The decoded payload\n    :raises ValueError: If the token is invalid or expired\n    \"\"\"\n    settings = get_settings()\n    try:\n        header = jwt.get_unverified_header(token)\n    except jwt.InvalidTokenError as e:\n        raise ValueError(f\"Invalid token: {str(e)}\") from e\n\n    algorithm = header.get(\"alg\", \"\")\n    if algorithm.startswith(\"HS\"):\n        if not settings.JWT_VERIFY_KEY:\n            raise ValueError(\"Invalid token: symmetric tokens are not accepted\")\n        key = settings.JWT_VERIFY_KEY\n        algorithms = [settings.JWT_ALGORITHM]\n    else:\n        if not settings.JWT_JWKS_URL:\n            raise ValueError(\"Invalid token: asymmetric tokens are not accepted\")\n        try:\n            key = _get_jwks_client().get_signing_key_from_jwt(token).key\n            algorithms = settings.JWT_JWKS_ALGORITHMS\n        except jwt.PyJWKClientError as e:\n            # The legacy verifier supported — and its config text recommended —\n            # asymmetric algorithms, with the public key in JWT_VERIFY_KEY. A\n            # token whose kid isn't in the Better Auth JWK set can therefore\n            # still be a live legacy session from that configuration, so the\n            # migration-window grace extends here too: fall back to the shared\n            # legacy key when it's configured for a matching asymmetric alg.\n            if (\n                settings.JWT_VERIFY_KEY\n                and not settings.JWT_ALGORITHM.startswith(\"HS\")","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py#L85-L121","documentation":"Error \"Invalid token: symmetric tokens are not accepted\" thrown in Significant-Gravitas/AutoGPT.","triggerScenarios":"Thrown at autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py:103 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an asymmetric (RS256/ES256) signed token; HS256 symmetric tokens are rejected by this verifier.","Check the token issuer configuration so it signs with the expected asymmetric algorithm."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}