What causes "invalid JWT token" in googleapis/mcp-toolbox?

Inspect the token contents at jwt.io for unusual or missing standard claims

invalid JWT token

Error message

invalid JWT token

What it means

jwt.Parse returned no error but token.Valid is false, meaning the token structurally parsed yet is not considered valid. With golang-jwt/v5 this state is rare (most invalid tokens return an error), but the library guards it explicitly and rejects the request with this message.

Source

Thrown at internal/auth/generic/generic.go:237

// Verifies generic JWT access token inside the Authorization header
func (a AuthService) GetClaimsFromHeader(ctx context.Context, h http.Header) (map[string]any, error) {
	if a.McpEnabled {
		return nil, nil
	}

	tokenString := h.Get(a.Name + "_token")
	if tokenString == "" {
		return nil, nil
	}

	// Parse and verify the token signature
	token, err := jwt.Parse(tokenString, a.kf.Keyfunc)
	if err != nil {
		return nil, fmt.Errorf("failed to parse and verify JWT token: %w", err)
	}

	if !token.Valid {
		return nil, fmt.Errorf("invalid JWT token")
	}

	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok {
		return nil, fmt.Errorf("invalid JWT claims format")
	}

	// Validate 'aud' (audience) claim
	aud, err := claims.GetAudience()
	if err != nil {
		return nil, fmt.Errorf("could not parse audience from token: %w", err)
	}

	isAudValid := false
	for _, audItem := range aud {
		if audItem == a.Audience {
			isAudValid = true
			break

View on GitHub (pinned to 8cc6e09de2)

Solutions

Inspect the token contents at jwt.io for unusual or missing standard claims
Obtain a fresh, normally-issued token from the authorization server
Ensure the client library issuing tokens is spec-compliant
Enable logging of the raw token header/payload to diagnose the anomaly

Defensive patterns

Strategy: try-catch

Validate before calling

// decode and sanity-check standard claims before sending
claims := decodePayload(tokenParts[1])
if _, ok := claims["exp"]; !ok {
    return fmt.Errorf("token missing exp claim; likely non-compliant issuer")
}

Try / catch

claims, err := authSvc.GetClaimsFromHeader(ctx, header)
if err != nil {
    if strings.Contains(err.Error(), "invalid JWT token") {
        return nil, http.StatusUnauthorized // structurally parsed but not valid
    }
    return nil, http.StatusInternalServerError
}

Prevention

Use a spec-compliant client library to obtain tokens
Reject hand-crafted or test tokens in production
Log the token header (never the signature) when debugging anomalies

When it happens

Trigger: jwt.Parse succeeds without error, but the resulting token's Valid flag is false during GetClaimsFromHeader — e.g. claims-type edge cases where validation did not complete normally.

Common situations: Tokens whose claims cannot be validated by the default validator; custom/edge-case tokens from non-standard issuers; typically indicates an unusual or hand-crafted token rather than a config problem.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/e55276b7dbcc6137. Report an issue: GitHub.