Getting error "Unable to verify JWT token payload " "invalid_grant" when testing with postman.

[khushi11]

We have configured Oauth in our system with this option "Create an OAuth JWT API endpoint for external clients". (Application registry) . We are able to generate JWT token with background script. When we are using JWT token to generate access token from postman we are getting below error message.

"error_description": "Unable to verify JWT token payload",    "error": "invalid_grant"

sometimes getting only "invalid_grant"

Everything looks good still it is not working.

Could you please suggest why we are getting this error.

FYI: We have validated JWT token in jwt.io and everything looks good.

Thanks

[GavinJolly]

It is always disappointing when there is a search result that matches your issue but it has 0 replies

[Fissuring]

I have received the same error. Looking for some solution

[GavinJolly]

Just to confirm you want to use a JWT from some source (ServiceNow, or other) to access ServiceNow APIs. I have made this work using AZURE AD to generate the JWT. It should largely be the same for ServiceNow generating the JWTs. Note the Error Code and messages  returned in the API is not always the correct error, just a default one. You need to enable OAUTH logging and look at the actual errors in the logs.

Here is my troubleshooting guide for the JWT and the Bearer Token. These are in my order of priority.

1. Decode the JWT and confirm it has the correct values.
   1. You can use VSCode or JWT.IO for this.
   2. Check that all the values in the Header, Body are correct.
   3. Using JWT.IO confirm the JWT is correctly encoded using the Public Key for the keypair
2. Check the API call to get the Bearer Token using the JWT is correct. Postman has been my friend on learning journey 
   1. URL: https://<<instance>>.service-now.com/oauth_token.do
   2. ClientID
   3. Client Secret
   4. Grant Type: urn:ietf:params:oauth:grant-type:jwt-bearer
   5. Assertion: is the encoded JWT
3. Ensure the Application is configured correctly with the ClientID, Secret, Scopes, OAUTH Provider Endpoint, etc
   1. If signed then ensure the KID and Public Keys are related to the application
   2. JWT Validation: Note: if you add a value in this list it will override other values. We had an issue where ServiceNow is out of data with Azure.
      We had to specify some JWT Validations to override the scripted expectations. From memory it was to add the Azure ApplicationID/ClientID for specific values.
4. Check the ServiceNow logs. (Ensure OAUTH Logging is turned on)
   1. The request for Bearer Token is logged
   2. Craft your queries to avoid the constant authentication events going on
   3. Note the Error Code and messages returned to Postman is not always the correct error, just a default one. You need to enable OAUTH logging and look at the actual errors in the logs.