# Error:Token's Signature resulted invalid when verified using the Algorithm: HmacSHA256

**URL:** <https://devforum.zoom.us/t/error-tokens-signature-resulted-invalid-when-verified-using-the-algorithm-hmacsha256/39296>\
**Category:** Web\
**Created:** [December 28, 2020, 11:58am UTC](https://devforum.zoom.us/t/error-tokens-signature-resulted-invalid-when-verified-using-the-algorithm-hmacsha256/39296 "2020-12-28T11:58:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dipankar86](https://avatars.discourse-cdn.com/v4/letter/d/2bfe46/32.png) [@dipankar86](https://devforum.zoom.us/u/dipankar86)\
**Post date:** [December 28, 2020, 11:58am UTC](https://devforum.zoom.us/t/error-tokens-signature-resulted-invalid-when-verified-using-the-algorithm-hmacsha256/39296/1 "2020-12-28T11:58:21Z")

</div>

Hi All,

I am using the below java code to generate JWT Token:-

```
    Map<String,Object> header = new HashMap<>();
	header.put(“alg”,“HS256”);
	header.put(“type”,“JWT”);
	
	 String headerEncode = Base64.getUrlEncoder().encodeToString(header.toString().getBytes());
	    SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
	    //SignatureAlgorithm.
	    //This is the secret
	    SecretKey key = Keys.hmacShaKeyFor("<API_SECRET>".getBytes(StandardCharsets.UTF_8));
	    //This is the key
	    String jwt = Jwts.builder().setHeader(header).setIssuer("<API_KEY>").
	            setExpiration(new Date(new Date().getTime()+80000000)).signWith(key,signatureAlgorithm).compact();
	    //System.out.println(headerEncode);
	    System.out.println(jwt);

```

I am getting the below error message when I am providing the token returned above to postman /v2/users endpoint:-

{  
“code”: 124,

“message”: “The Token’s Signature resulted invalid when verified using the Algorithm: HmacSHA256”

}

The behaviour is same when I am generating the token provided to me by [jwt.io](http://jwt.io) as well. This was working a week earlier without any issues.  
Please let me know what is wrong here? Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [December 28, 2020, 11:35pm UTC](https://devforum.zoom.us/t/error-tokens-signature-resulted-invalid-when-verified-using-the-algorithm-hmacsha256/39296/2 "2020-12-28T23:35:06Z")

</div>

Hey @dipankar86,

Thank you for reaching out to the Zoom Developer Forum. I’m not familiar with using this signing flow with Java but I’m thinking that using `io.jsonwebtoken.security.Keys.hmacShaKeyFor` creates a key with the wrong bit-depth. Please use the Java method outlined in our [Generate a Signature](https://marketplace.zoom.us/docs/sdk/native-sdks/web/build/signature) documentation to see if that resolves your issues.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/4/8/4893122ff08af56aa61892c1fd09027062445332.png)

This also seems like an issue that would bets fit our #client-web-sdk category so I’ll move it over there. I hope that helps! Let me know if you have any questions.

Thanks,  
Max

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [January 28, 2021, 9:35am UTC](https://devforum.zoom.us/t/error-tokens-signature-resulted-invalid-when-verified-using-the-algorithm-hmacsha256/39296/3 "2021-01-28T09:35:10Z")

</div>

Closed on January 28, 2021, 9:35am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.