title: Unable to validate access token signature obtained from Azure AD in order to secure Web API
body: <p>I am trying to secure my web api (.net core 2.2) with Azure Ad using implicit flow.</p>
  
  <p>I registered my application in Azure AD using the Azure Portal > Azure Active Directoy > App Registrations > New Application Registration:</p>
  
  <p>Name = MyWebApi</p>
  
  <p>Application Type = Web app / API</p>
  
  <p>Sign-on URL = <a href="http://localhost:55000" rel="noreferrer">http://localhost:55000</a></p>
  
  <p>Once this app is created, I opened its Manifest file and changed <em>oauth2AllowImplicitFlow</em> from <em>false</em> to <em>true</em>.</p>
  
  <p>Thats all I did for the app registration in azure portal.</p>
  
  <p>Then I called the following URL manually from my chrome browser to get access_token:</p>
  
  <p><a href="https://login.microsoftonline.com/MY-AD-TENANT-GUID/oauth2/v2.0/authorize?client_id=MY-REGISTERED-APP-GUID&amp;response_type=token&amp;redirect_uri=http%3A%2F%2Flocalhost%3A55000&amp;scope=openid&amp;response_mode=fragment" rel="noreferrer">https://login.microsoftonline.com/MY-AD-TENANT-GUID/oauth2/v2.0/authorize?client_id=MY-REGISTERED-APP-GUID&amp;response_type=token&amp;redirect_uri=http%3A%2F%2Flocalhost%3A55000&amp;scope=openid&amp;response_mode=fragment</a></p>
  
  <p>the response from calling the above url is:</p>
  
  <p><a href="http://localhost:55000/#access_token=MY-ACCESS-TOKEN&amp;token_type=Bearer&amp;expires_in=3600&amp;scope=profile+openid+email+00000003-0000-0000-c000-000000000000%2fUser.Read&amp;session_state=b2be972a-cfbc-49f1-bfc0-6c93f6c87d02" rel="noreferrer">http://localhost:55000/#access_token=MY-ACCESS-TOKEN&amp;token_type=Bearer&amp;expires_in=3600&amp;scope=profile+openid+email+00000003-0000-0000-c000-000000000000%2fUser.Read&amp;session_state=b2be972a-cfbc-49f1-bfc0-6c93f6c87d02</a></p>
  
  <p>when I pass MY-ACCESS-TOKEN as Bearer token in Authorization header to my Web API (.net core 2.2) I get the following exception:</p>
  
  <p>Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10511: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey , KeyId: N-lC0n-9DALqwhuHYnHQ63GeCXc'.</p>
  
  <p>I then tried manually verifying the signature:</p>
  
  <p>when I paste MY-ACCESS-TOKEN in <a href="https://jwt.io/" rel="noreferrer">https://jwt.io/</a> the header is:</p>
  
  <pre><code>{
  
    "typ": "JWT",
  
    "nonce": "AQABAAAAAACEfexXxjamQb3OeGQ4Gugvm6YdOT-bkA0IPllKMt06-J8If5AQ075TVCav94X_ZYcEYKaPneqdJcqYry-Z4XjX0eMN_fiJX_8wXe9D2b6eRiAA",
  
    "alg": "RS256",
  
    "x5t": "N-lC0n-9DALqwhuHYnHQ63GeCXc",
  
    "kid": "N-lC0n-9DALqwhuHYnHQ63GeCXc"
  
  }
  </code></pre>
  
  <p>I then went to this URL to obtain the public key for kid: N-lC0n-9DALqwhuHYnHQ63GeCXc</p>
  
  <p><a href="https://login.microsoftonline.com/common/discovery/keys" rel="noreferrer">https://login.microsoftonline.com/common/discovery/keys</a></p>
  
  <p>I then pasted the following as a public key on jwt.io to validated token signature:</p>
  
  <pre><code>-----BEGIN CERTIFICATE-----
  
  OBTAINED-PUBLIC-KEY-FROM-THE-ABOVE-URL-HERE
  
  -----END CERTIFICATE-----
  </code></pre>
  
  <p>and I again get <strong>Invalid Signature</strong>.</p>
  
  <p>I have been to this thread: <a href="https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/609" rel="noreferrer">https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/609</a>, but I am not sure why does my token header has <strong>nonce</strong> value or if this is an issue at all in my case or not.</p>
  
  <p>Any ideas what I am doing wrong here?</p>