Replies: 0
I’m trying to login with a token generated by the JWT Authentication for WP REST API plugin: https://wordpress.org/plugins/jwt-authentication-for-wp-rest-api/
However, I am getting “Signature verification failed” or “Invalid Auth Code ( auth_key ) provided.”
Here is how I’m trying to archive this:
On wp-config.php, I have several variables for JWT settings:
AUTH_KEY
SECURE_AUTH_KEY
LOGGED_IN_KEY
NONCE_KEY
AUTH_SALT
SECURE_AUTH_SALT
LOGGED_IN_SALT
NONCE_SALT
and
JWT_AUTH_SECRET_KEY
I know theses setting are working because a POST request to {base-url}/wp-json/jwt-auth/v1/token with a username and password brings a response with a token key…
…and I know this token value (JWT) is valid because:
– I can validate it by verifying its signature with ‘AUTH_KEY’ (AUTH_KEY_VALUE);
– I can decode it and its decoding brings:
– header: {
“typ”: “JWT”,
“alg”: “HS256”
}
– payload: {
“iss”: {base-url},
“iat”: 1585476672,
“nbf”: 1585476672,
“exp”: 1586081472,
“data”: {
“user”: {
“id”: “1247”
}
}
}
On Simple JWT Login Settings I defined:
– General tab:
– JWT Decryption Key / JWT decryption signature: JWT_AUTH_SECRET_KEY
– JWT Decrypt Algorithm: HS256
– Auth Codes tab:
– Auth Code URL Key: “auth_key”
– Auth Codes: AUTH_KEY
– Auth Codes tab:
– Allow Auto-Login as Yes
– Auto-Login Requires Auth Code: I’ve tried both “No” and “Yes” which brings different erros
– JWT Login Settings: I’ve tried both “Log in by Email” and “Log in by WordPress User ID”
– JWT parameter key: I’ve tried: data.user.id, user.id, id, etc, etc.. o difference
I’m trying to autologin via browser or Postman via GET request to:
– when Auto-Login Requires Auth Code: No => {base-url}?rest_route=/simple-jwt-login/v1/autologin&jwt=JWT
– its response is: {
“success”: false,
“data”: {
“message”: “Signature verification failed”,
“errorCode”: 11
}
}
– when Auto-Login Requires Auth Code: Yes => ?rest_route=/simple-jwt-login/v1/autologin&jwt=JWT&auth_key=AUTH_KEY_VALUE
– its response is: {
“success”: false,
“data”: {
“message”: “Invalid Auth Code ( auth_key ) provided.”,
“errorCode”: 27
}
}
Why AUTH_KEY_VALUE is said to be invalid if its its signature it verified?
What I doing wrong here?
Thank you very much.