lcobucci/jwt · error · ConstraintViolation

The token is not identified with the expected ID

Error message

The token is not identified with the expected ID

What it means

This ConstraintViolation is thrown by the IdentifiedBy validation constraint of lcobucci/jwt. It fires when the token's `jti` (JWT ID) claim does not equal the ID configured in the constraint, or when the token has no `jti` at all. The constraint exists to let applications reject tokens that are not the specific token instance they expect (e.g. for single-use or revocation checks).

Solutions

1. Ensure the token is created with ->identifiedBy('expected-id') in the builder so the `jti` claim is present and matches.
2. Check the exact ID string passed to the IdentifiedBy constraint and compare it (case-sensitively) with the token's `jti` claim.
3. If the token legitimately has no `jti`, remove the IdentifiedBy constraint from the validator configuration.
4. Log/inspect the received token's `jti` (e.g. $token->claims()->get('jti')) to see what is actually being compared.

Example fix

// before: token built without jti
$token = $config->builder()->withClaim('sub', 'user1')->getToken($config->signer(), $config->signingKey());
$validator->assert($token, $constraints); // throws

// after: build the token with the expected ID
$token = $config->builder()
    ->identifiedBy('expected-id')
    ->withClaim('sub', 'user1')
    ->getToken($config->signer(), $config->signingKey());

$jti = $token->claims()->get('jti');
if ($jti === null || $jti !== $expectedId) {
    // reject before calling the constraint
}

function hasExpectedId(Lcobucci\JWT\Token $token, string $expectedId): bool
{
    $jti = $token->claims()->get('jti');
    return is_string($jti) && $jti === $expectedId;
}

try {
    $validator->assert($token, $constraints);
} catch (Lcobucci\JWT\Validation\ConstraintViolation $e) {
    if ($e->getConstraint() instanceof Lcobucci\JWT\Validation\Constraint\IdentifiedBy) {
        // token id mismatch: treat as unauthorized
    }
}

When it happens

Trigger: Calling IdentifiedByConstraint::assert($token) where Token::isIdentifiedBy($this->id) returns false — i.e. the token lacks a `jti` claim, or its `jti` claim value differs from the id passed to the constraint's constructor.

Common situations: Verifying a token against IdentifiedBy::constraint('some-id') when the token was minted without a `jti` claim (the builder was not told ->identifiedBy(...)); comparing against an ID from a database record that was regenerated; typos or case mismatches in the expected ID; reusing a validation configuration copied from another token.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• The token was not issued by the given issuers
• The token is expired
• The token cannot be used yet
• No constraint given.
• Error while encoding to JSON

AI-assisted analysis of lcobucci/jwt@375813049c (2026-09-14). Data as JSON: /api/errors/437c0c66ca752c08. Report an issue: GitHub.

Appendix: source

Thrown at src/Validation/Constraint/IdentifiedBy.php:20

declare(strict_types=1);

namespace Lcobucci\JWT\Validation\Constraint;

use Lcobucci\JWT\Token;
use Lcobucci\JWT\Validation\Constraint;
use Lcobucci\JWT\Validation\ConstraintViolation;

final readonly class IdentifiedBy implements Constraint
{
    /** @param non-empty-string $id */
    public function __construct(private string $id)
    {
    }

    public function assert(Token $token): void
    {
        if (! $token->isIdentifiedBy($this->id)) {
            throw ConstraintViolation::error(
                'The token is not identified with the expected ID',
                $this,
            );
        }
    }
}

View on GitHub (pinned to 375813049c)