# OAuth2 JWT assertion - 401 unauthorized

**URL:** <https://devforum.okta.com/t/oauth2-jwt-assertion-401-unauthorized/31450>\
**Category:** OAuth/OIDC\
**Tags:** spring, java\
**Created:** [December 10, 2024, 10:16pm UTC](https://devforum.okta.com/t/oauth2-jwt-assertion-401-unauthorized/31450 "2024-12-10T22:16:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcduser999](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@mcduser999](https://devforum.okta.com/u/mcduser999)\
**Post date:** [December 10, 2024, 10:16pm UTC](https://devforum.okta.com/t/oauth2-jwt-assertion-401-unauthorized/31450/1 "2024-12-10T22:16:56Z")

</div>

Hello!

I’m having some trouble getting JWT assertions to work in a Spring Boot application for an Okta Open ID application integration.

Note the Spring Boot app works with this same OKTA application using client secret, and works with Entra ID for both client secret and JWT assertions.

However, when I try to authenticate with Okta using a JWT assertion, it returns a 401 unauthorized error message as follows:

org.springframework.web.reactive.function.client.WebClientResponseException$Unauthorized: 401 Unauthorized from POST [https://dev-60265957.okta.com/oauth2/default/v1/token](https://dev-60265957.okta.com/oauth2/default/v1/token)

This is the JSON version of the public key, which I upload to the Okta app:

{  
“kty”: “RSA”,  
“e”: “AQAB”,  
“n”: “r9IcVK\_9POl3R…”,  
“use”: “sig”,  
“kid”: “abc”,  
“alg”: “RS256”  
}

I also validated the JWT assertion against the public key using [jwt.io](http://jwt.io), and it confirms the signature is verified (see image)

 ![validatedJwtImage](https://global.discourse-cdn.com/oktadev/original/2X/0/015d8fec0dc9f00276fbea7bc975767c15b555f0.jpeg)

Below is the authorization code request, which as I said works fine with client secret:

[https://dev-60265957.okta.com/oauth2/default/v1/authorize?client\_id=0oaljin739TC](https://dev-60265957.okta.com/oauth2/default/v1/authorize?client_id=0oaljin739TC)  
pu5Bu5d7&redirect\_uri=https%3A%2F%2Flocalhost%3A8443%2Fmy\_redirect\_api&response\_type=code&scope=openid%20email%20profile%20offline\_access&sso\_reload=true&state=aaaa&nonce=bbbb

Any ideas on what I’m doing wrong for the JWT assertion?

Thanks!

---

<div class="post-metadata">

**Author:** ![mcduser999](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@mcduser999](https://devforum.okta.com/u/mcduser999)\
**Post date:** [December 13, 2024, 3:31pm UTC](https://devforum.okta.com/t/oauth2-jwt-assertion-401-unauthorized/31450/2 "2024-12-13T15:31:29Z")

</div>

I’ve finally found the solution to this. The problem was that the header of the JWT assertion needs to contain a “kid” field, which needs to match the kid of the public key which is uploaded to the server.

For some reason, this isn’t mentioned in the documentation, or maybe I just missed it.

In fact, the OKTA server does provide helpful error messages, but for some reason they don’t show up in the generated exception in Spring Boot.

I tried a few different things, but the one that worked was to copy the generated JWT into a curl command and call the the API from that.

Here’s an example:

@echo off  
REM Set your variables  
set CLIENT\_ID=0oalji…  
set AUTH\_CODE=NXNGkZzy1xCg9dVGA58qr9INOpQAuNohKrp6acFO8vQ&  
set JWT\_ASSERTION=eyJ4NXQi…  
set REDIRECT\_URI=[https://localhost:9444/callback](https://localhost:9444/callback)

REM Make the cURL request  
curl -X POST [https://dev-60265957.okta.com/oauth2/default/v1/token](https://dev-60265957.okta.com/oauth2/default/v1/token) ^  
-H “Content-Type: application/x-www-form-urlencoded” ^  
-d “grant\_type=authorization\_code” ^  
-d “code=%AUTH\_CODE%” ^  
-d “redirect\_uri=%REDIRECT\_URI%” ^  
-d “client\_id=%CLIENT\_ID%” ^  
-d “client\_assertion\_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer” ^  
-d “client\_assertion=%JWT\_ASSERTION%”

REM Pause to keep the window open and see the output  
pause

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [December 14, 2024, 3:31pm UTC](https://devforum.okta.com/t/oauth2-jwt-assertion-401-unauthorized/31450/3 "2024-12-14T15:31:50Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.