title: Okta validating JWT token using public keys from OpenID Connect config
body: <p><strong>Background</strong></p>
  
  <p>I followed this tutorial from Okta:
  <a href="https://developer.okta.com/quickstart/#/ios/dotnet/aspnetcore" rel="nofollow noreferrer">https://developer.okta.com/quickstart/#/ios/dotnet/aspnetcore</a></p>
  
  <p>Implemented a version of the open source AppAuth.iOS component from Xamarin to be able to use it in a Xamarin.iOS project. (works)</p>
  
  <p>Created a simple asp.net core web-service as demonstrated in the article above and configured as instructed.</p>
  
  <p><strong>Problem:</strong></p>
  
  <p>I receive a JWT access token after successfully authenticating through the mobile app and use this token to call the test web-service. Web-service fails to validate the token with the following error message</p>
  
  <p><strong>Error:</strong></p>
  
  <p><code>Signature validation failed. Unable to match keys: 'HD3v3KXvARUyg_9i26m2i8itsCY7TpA0-ajhcOsBdkM', 
  token: '{"alg":"RS256","typ":"JWT","kid":"HD3v3KXvARUyg_9i26m2i8itsCY7TpA0-ajhcOsBdkM"}.{"ver":1,"jti":"AT.J4uuLmOgCLslqlnUzNbjhw7dzm5KurJVJxHNIXZx-g8.zQJUh4NcHWcIBvdWVLy7fXea4cCoPxv7Avh3+z6PiGM=","iss":"https://dev-111111.oktapreview.com","aud":"https://dev-111111.oktapreview.com","sub":"dsamuylov@111111.com","iat":1527861992,"exp":1527865592,"cid":"0oafa27024puCyvwi0h7","uid":"00uf9rphkt6D8gcXI0h7","scp":["offline_access","openid","profile"]}'.
     at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
     at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken&amp; validatedToken)
     at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
  </code></p>
  
  <p><strong>Debugging:</strong></p>
  
  <p>After inspecting the JWT token using <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a> I found the <code>kid</code> of the signing public key used to sign the token</p>
  
  <p>Then I went to my account's openid-connect configuration
  <a href="https://dev-111111.oktapreview.com/oauth2/default/.well-known/openid-configuration" rel="nofollow noreferrer">https://dev-111111.oktapreview.com/oauth2/default/.well-known/openid-configuration</a> </p>
  
  <p>Found the keys url <a href="https://dev-111111.oktapreview.com/oauth2/default/v1/keys" rel="nofollow noreferrer">https://dev-111111.oktapreview.com/oauth2/default/v1/keys</a></p>
  
  <p>There's only 1 key listed there and its <code>kid</code> <strong>does not match the one in the token header</strong></p>
  
  <p><strong>Question:</strong></p>
  
  <p>Why would that happen if I am using the same Okta account/server for both the mobile client and the web-service? Where is this key mismatch coming from?</p>
  
  <p>Really hoping someone from Okta technical team can weigh in and shed light on this because as is, the guided walkthrough linked at the start of the question doesn't work.</p>
  
  <p>Thank you,</p>
  
  <p>Dmitry</p>