JWT has an invalid signature

[devanshithakar12]

I am using the SSE Transport type and am able to successfully call the tool. However, the result shows "JWT has an invalid signature" instead of the user data. I've tried to hard code the access token but no luck. Any guidance on how I could fix this? Thank you!

[svandenhoven]

I have the same issue.

If I log the created access token it does indeed have an invalid signature if it is checked by jwt token tools like jwt.io.

I also see that the audience of the access token that is sent to the azure function has audience "00000003-0000-0000-c000-000000000000" instead of the expected api://appreg-client-id

Can you advise what resolution might be?

[svandenhoven]

I found that the scope for the requested accesstoken is User.Read. This results in an access-token that has the audience of Microsoft Graph Api (00000003-0000-0000-c000-000000000000). I have changed that in a fork of the repo https://github.com/svandenhoven/remote-auth-mcp-apim-py/tree/sandervd/invalid-signature.

Here I add a scope via "Expose an API", set the application URI ID and change the scope of the requested access-token. This results in an access token with correct audience (api://) and correct signature. This can then be exchanged into an access token for Graph using the OBO flow in the azure function (or any access token that is consented).

Would this be correct resolution for the above issue?