{"record":{"id":"d2b90fd371963d7e","repo":"Significant-Gravitas/AutoGPT","slug":"invalid-token-str-e","errorCode":null,"errorMessage":"Invalid token: {str(e)}","messagePattern":"Invalid token: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":401,"severity":"error","filePath":"autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py","lineNumber":98,"sourceCode":"\n    Symmetric (HS*) tokens are verified with the shared secret\n    (`JWT_VERIFY_KEY`); asymmetric tokens are verified against the JWK set\n    published by the platform auth service (`JWT_JWKS_URL`). Both paths can be\n    active at once, which keeps sessions issued by a previous auth provider\n    valid during a migration window.\n\n    :param token: The token to parse\n    :param audience: The `aud` claim the token must carry. Defaults to the\n        user-token audience; service tokens use a distinct audience so the\n        two planes can't be replayed against each other.\n    :return: The decoded payload\n    :raises ValueError: If the token is invalid or expired\n    \"\"\"\n    settings = get_settings()\n    try:\n        header = jwt.get_unverified_header(token)\n    except jwt.InvalidTokenError as e:\n        raise ValueError(f\"Invalid token: {str(e)}\") from e\n\n    algorithm = header.get(\"alg\", \"\")\n    if algorithm.startswith(\"HS\"):\n        if not settings.JWT_VERIFY_KEY:\n            raise ValueError(\"Invalid token: symmetric tokens are not accepted\")\n        key = settings.JWT_VERIFY_KEY\n        algorithms = [settings.JWT_ALGORITHM]\n    else:\n        if not settings.JWT_JWKS_URL:\n            raise ValueError(\"Invalid token: asymmetric tokens are not accepted\")\n        try:\n            key = _get_jwks_client().get_signing_key_from_jwt(token).key\n            algorithms = settings.JWT_JWKS_ALGORITHMS\n        except jwt.PyJWKClientError as e:\n            # The legacy verifier supported — and its config text recommended —\n            # asymmetric algorithms, with the public key in JWT_VERIFY_KEY. A\n            # token whose kid isn't in the Better Auth JWK set can therefore\n            # still be a live legacy session from that configuration, so the","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py#L80-L116","documentation":"Error \"Invalid token: {str(e)}\" thrown in Significant-Gravitas/AutoGPT.","triggerScenarios":"Thrown at autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py:98 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Obtain a fresh token by signing in again; the current token is malformed or tampered with.","Verify the token is not truncated or corrupted in transit (check proxies/header size limits)."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}