I just can’t seem to get the JWT right for authentication.
All examples of JWT use HMAC which is HS256 not RS256 which is what they require.
I’m using openssl to generate the RS256 signature but the IRS is reporting:
“ERSV306 - The given JWT for client authentication is invalid”
Not very helpful as to what about it is invalid.
I’ve looked though all the error codes and do not see one about the signature, the user ID or anything else to help eliminate parts of the JWT as causing the problem.
The JWT is supposed to be “signed with a private key” - which I assume, probably incorrectly, that the signature component is the signature of the header and payload (header.payload.signature) which is what is normally an HMAC(header.payload).
This is the kind of thing that Chatgpt works pretty well for.
But generally, if you have a private key, then the other end needs your public key to decrypt.
The issue I guess I’m having is since I can’t use HMAC, do I take the Hash of the encoded header + payload before singing it? I’ve tried both ways and get the same error.
Are they able to decode it okay but then does the error mean the information in the payload is not valid.
Or is the key I provided them not working?
None of the other error messages say things like “can’t decrypt” or “invalid client ID”.
The actual post contains 2 JWTs. One us called the ‘User’ and the other the ‘Client’.
The client is second, so does this mean the User is Okay?
Of course, being the IRS there is no way to contact them without waiting on hold for 4 hours and hoping you can get someone that can answer these questions.
So I was hoping someone here might have worked with this successfully.
1 Like
While you are waiting for a real answer, 
This “debugger” on this site looks like it would be useful. https://jwt.io/
I’ve been using that unsuccessfully, but my understanding is the IRS is doing ‘something different’.
The info I’ve found is comments from developers saying things like “this is the worst experience of my career”. Yeah. I tend to agree.
1 Like