{"record":{"id":"f0584c4702b900e2","repo":"Significant-Gravitas/AutoGPT","slug":"invalid-token-asymmetric-tokens-are-not-accepted","errorCode":null,"errorMessage":"Invalid token: asymmetric tokens are not accepted","messagePattern":"Invalid token: asymmetric tokens are not accepted","errorType":"exception","errorClass":"ValueError","httpStatus":401,"severity":"error","filePath":"autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py","lineNumber":108,"sourceCode":"        two planes can't be replayed against each other.\n    :return: The decoded payload\n    :raises ValueError: If the token is invalid or expired\n    \"\"\"\n    settings = get_settings()\n    try:\n        header = jwt.get_unverified_header(token)\n    except jwt.InvalidTokenError as e:\n        raise ValueError(f\"Invalid token: {str(e)}\") from e\n\n    algorithm = header.get(\"alg\", \"\")\n    if algorithm.startswith(\"HS\"):\n        if not settings.JWT_VERIFY_KEY:\n            raise ValueError(\"Invalid token: symmetric tokens are not accepted\")\n        key = settings.JWT_VERIFY_KEY\n        algorithms = [settings.JWT_ALGORITHM]\n    else:\n        if not settings.JWT_JWKS_URL:\n            raise ValueError(\"Invalid token: asymmetric tokens are not accepted\")\n        try:\n            key = _get_jwks_client().get_signing_key_from_jwt(token).key\n            algorithms = settings.JWT_JWKS_ALGORITHMS\n        except jwt.PyJWKClientError as e:\n            # The legacy verifier supported — and its config text recommended —\n            # asymmetric algorithms, with the public key in JWT_VERIFY_KEY. A\n            # token whose kid isn't in the Better Auth JWK set can therefore\n            # still be a live legacy session from that configuration, so the\n            # migration-window grace extends here too: fall back to the shared\n            # legacy key when it's configured for a matching asymmetric alg.\n            if (\n                settings.JWT_VERIFY_KEY\n                and not settings.JWT_ALGORITHM.startswith(\"HS\")\n                and algorithm == settings.JWT_ALGORITHM\n            ):\n                key = settings.JWT_VERIFY_KEY\n                algorithms = [settings.JWT_ALGORITHM]\n            else:","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py#L90-L126","documentation":"Error \"Invalid token: asymmetric tokens are not accepted\" thrown in Significant-Gravitas/AutoGPT.","triggerScenarios":"Thrown at autogpt_platform/autogpt_libs/autogpt_libs/auth/jwt_utils.py:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a symmetric (HS256) signed token; asymmetric tokens are rejected by this verifier.","Check the token issuer configuration so it signs with the expected symmetric algorithm."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}