{"record":{"id":"aade770663331cc5","repo":"crewAIInc/crewAI","slug":"invalid-token-issuer-got-actual-issuer-expe","errorCode":null,"errorMessage":"Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'","messagePattern":"Invalid token issuer\\. Got: '(.+?)'\\. Expected: '(.+?)'","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"lib/crewai-core/src/crewai_core/auth/utils.py","lineNumber":63,"sourceCode":"            options={\n                \"verify_signature\": True,\n                \"verify_exp\": True,\n                \"verify_nbf\": True,\n                \"verify_iat\": True,\n                \"require\": [\"exp\", \"iat\", \"iss\", \"aud\", \"sub\"],\n            },\n        )\n\n    except jwt.ExpiredSignatureError as e:\n        raise Exception(\"Token has expired.\") from e\n    except jwt.InvalidAudienceError as e:\n        actual_audience = _unverified_decoded_token.get(\"aud\", \"[no audience found]\")\n        raise Exception(\n            f\"Invalid token audience. Got: '{actual_audience}'. Expected: '{audience}'\"\n        ) from e\n    except jwt.InvalidIssuerError as e:\n        actual_issuer = _unverified_decoded_token.get(\"iss\", \"[no issuer found]\")\n        raise Exception(\n            f\"Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'\"\n        ) from e\n    except jwt.MissingRequiredClaimError as e:\n        raise Exception(f\"Token is missing required claims: {e!s}\") from e\n    except jwt.exceptions.PyJWKClientError as e:\n        raise Exception(f\"JWKS or key processing error: {e!s}\") from e\n    except jwt.InvalidTokenError as e:\n        raise Exception(f\"Invalid token: {e!s}\") from e\n","sourceCodeStart":45,"sourceCodeEnd":72,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/crewai-core/src/crewai_core/auth/utils.py#L45-L72","documentation":"Error \"Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'\" thrown in crewAIInc/crewAI.","triggerScenarios":"Thrown at lib/crewai-core/src/crewai_core/auth/utils.py:63 when the library encounters an invalid state.","commonSituations":"Occurs when the token's issuer claim does not match the configured issuer. Verify the token was issued by the expected identity provider.","solutions":["Verify the token issuer matches the configured issuer URL.","Check that the token came from the expected identity provider/tenant."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}