# Resource Server - Invalid Token, Invalid JOSE header error

**URL:** <https://devforum.okta.com/t/resource-server-invalid-token-invalid-jose-header-error/2563>\
**Category:** Questions\
**Tags:** spring, java\
**Created:** [August 25, 2018, 7:46pm UTC](https://devforum.okta.com/t/resource-server-invalid-token-invalid-jose-header-error/2563 "2018-08-25T19:46:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marc](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@marc](https://devforum.okta.com/u/marc)\
**Post date:** [August 25, 2018, 7:46pm UTC](https://devforum.okta.com/t/resource-server-invalid-token-invalid-jose-header-error/2563/1 "2018-08-25T19:46:20Z")

</div>

Hi,  
I am trying to protect my SOAP based webservice with Okta OAuth2 authentication mechanism using spring.  
My app is not based on spring boot, but I integrated the app with spring security. Below is the configuration for my app which acts as Resource Server for validating the jwt token and provides access to the resource.

```
@Configuration
@EnableResourceServer
@EnableWebSecurity
@PropertySource({"classpath:config/OAuth2.properties"})
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{
	
	 @Autowired
	 private Environment env;

	    public void configure (ResourceServerSecurityConfigurer resources) throws Exception {

	        JwkTokenStore tokenStore = new JwkTokenStore(env.getProperty("jwk.key-set-uri"));
	        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
	        defaultTokenServices.setTokenStore(tokenStore);
	        resources.resourceId(env.getProperty("authorization-server-id"));
	        resources.tokenServices(defaultTokenServices);
	        resources.tokenStore(tokenStore);
	    }

	    public void configure(HttpSecurity http) throws Exception {
	        RequestMatcher requestMatcher = new AntPathRequestMatcher("/web/**");
	        http.requestMatcher(requestMatcher).authorizeRequests().anyRequest().authenticated()
	                .and()
	                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
	    }
}

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer{
	 public SecurityWebApplicationInitializer() {
	        super(ResourceServerConfig.class);
	    }
}

```

below are the properties I am using for the jwt key verification…

```
jwk.key-set-uri=https://MyCompany.oktapreview.com/oauth2/ausdwc45p9oaj8Bv00t7/v1/keys
authorization-server-id=Default

```

My Auth server name is Default and so i am using server-Id as Default.

I am getting Below error when testing my service.

{  
“error”: “invalid\_token”,  
“error\_description”: “Invalid JOSE Header kid (nkNj\_A6sWlAAjHC-KwTAaUSDrnLlRQoJTNhjhgjA7M4LBa1k)”  
}

I am struck and any help is greatly appreciated.

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [August 26, 2018, 3:00pm UTC](https://devforum.okta.com/t/resource-server-invalid-token-invalid-jose-header-error/2563/2 "2018-08-26T15:00:44Z")

</div>

Does it work if you set your authorization-server-id to ausdwc45p9oaj8Bv00t7?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 12, 2024, 11:01pm UTC](https://devforum.okta.com/t/resource-server-invalid-token-invalid-jose-header-error/2563/3 "2024-01-12T23:01:41Z")

</div>