# Error while validating access token

**URL:** <https://devforum.okta.com/t/error-while-validating-access-token/14281>\
**Category:** Questions\
**Created:** [May 18, 2021, 7:24am UTC](https://devforum.okta.com/t/error-while-validating-access-token/14281 "2021-05-18T07:24:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![roulupen](https://avatars.discourse-cdn.com/v4/letter/r/d9b06d/32.png) [@roulupen](https://devforum.okta.com/u/roulupen)\
**Post date:** [May 18, 2021, 7:24am UTC](https://devforum.okta.com/t/error-while-validating-access-token/14281/1 "2021-05-18T07:24:26Z")

</div>

Hi,

When we are sending the access token to the server for consuming some resources then that time I’m using the following instructions to validate the access token but every time it’s failing with the error “A signing key must be specified if the specified JWT is digitally signed.] with root cause”.

[https://developer.okta.com/docs/guides/validate-access-tokens/java/overview/#decoding-and-validating-the-access-token](https://developer.okta.com/docs/guides/validate-access-tokens/java/overview/#decoding-and-validating-the-access-token)

For me, the issuer is: [https://xxxxx-stage.okta.com](https://xxxxx-stage.okta.com)  
the audience is: [https://xxxx-stage.okta.com](https://xxxx-stage.okta.com)

I have verified this using the introspect API call but need to validate at resource server.

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [May 18, 2021, 11:37am UTC](https://devforum.okta.com/t/error-while-validating-access-token/14281/2 "2021-05-18T11:37:22Z")

</div>

To validate tokens, you need to have a custom authorization server. If you have a developer account, you should have one named “default” in Security \> API. Its issuer URI ends in `/oauth2/default`.

See our docs for more information on the difference between an org authorization server and a custom one.

[https://developer.okta.com/docs/concepts/auth-servers/](https://developer.okta.com/docs/concepts/auth-servers/)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 6:11pm UTC](https://devforum.okta.com/t/error-while-validating-access-token/14281/3 "2024-02-08T18:11:14Z")

</div>

Closed on February 8, 2024, 6:11pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.