crewAIInc/crewAI · error · Exception

Invalid token issuer. Got: '{actual_issuer}'. Expected: '{is

Error message

Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'

What it means

Error "Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'" thrown in crewAIInc/crewAI.

Source

Thrown at lib/crewai-core/src/crewai_core/auth/utils.py:63

            options={
                "verify_signature": True,
                "verify_exp": True,
                "verify_nbf": True,
                "verify_iat": True,
                "require": ["exp", "iat", "iss", "aud", "sub"],
            },
        )

    except jwt.ExpiredSignatureError as e:
        raise Exception("Token has expired.") from e
    except jwt.InvalidAudienceError as e:
        actual_audience = _unverified_decoded_token.get("aud", "[no audience found]")
        raise Exception(
            f"Invalid token audience. Got: '{actual_audience}'. Expected: '{audience}'"
        ) from e
    except jwt.InvalidIssuerError as e:
        actual_issuer = _unverified_decoded_token.get("iss", "[no issuer found]")
        raise Exception(
            f"Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'"
        ) from e
    except jwt.MissingRequiredClaimError as e:
        raise Exception(f"Token is missing required claims: {e!s}") from e
    except jwt.exceptions.PyJWKClientError as e:
        raise Exception(f"JWKS or key processing error: {e!s}") from e
    except jwt.InvalidTokenError as e:
        raise Exception(f"Invalid token: {e!s}") from e

View on GitHub (pinned to 754d7323be)

Solutions

1. Verify the token issuer matches the configured issuer URL.
2. Check that the token came from the expected identity provider/tenant.

When it happens

Trigger: Thrown at lib/crewai-core/src/crewai_core/auth/utils.py:63 when the library encounters an invalid state.

Common situations: Occurs when the token's issuer claim does not match the configured issuer. Verify the token was issued by the expected identity provider.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/aade770663331cc5. Report an issue: GitHub.