JWT verification "invalid number of segments"

I’m wondering if anyone else has come across this error.

I’ve setup a custom verifier (twice) and testing each time leads to the same error:

extract from compact serialization format: invalid number of segments failed to verify jws signature: failed extract from compact serialization format: invalid number of segments]

I’ve run the JWT through the debugger at https://jwt.io/, and I can confirm it has the correct headers

And I know that the JWK endpoint returns the correct data (example endpoint: https://test.stytch.com/v1/sessions/jwks/project-test-6a69f2a0-57b4-4935-a518-46c8582ef849)

{
  "keys": [
    {
      "alg": "RS256",
      "e": "AQAB",
      "key_ops": [
        "verify"
      ],
      "kid": "jwk-live-cef896b2-c413-4998-9ec8-2b748533f445",
      "kty": "RSA",
      "n": "0SQx5Tp0wc4vZIIrnOmkJyWCYykoutvwiAzT3Yni29g6q150rbl8GY7321x8D0GTPCtj_cI2jXaYP6VU7MW9MOZrmeE3qSxAuxFABtwRJiaK1QrdjWv7lrWD9tnkldsGKEjSlgbUtB0bR6DKco8UQ5mLG6gcGR1tPZzq9AMgA3BCgvGkaKOIAfsziCK8FBJcf2uy4ZqYHEkgHSdH0gpOhUmIwvUiWNrssr1XOE6wnqtS7rvrycA9BeCJS5t4PLCx864oyl-GLRpY6fnpGNxMMAHNnT3vKu3uPg9xWidewRMxZ9se4x6tIzXxpSuVytYL6rIwgdtR2jvwm9r-G_Qv2w",
      "use": "sig",
      "x5c": [
        "MIICfTCCAWWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAAMCIYDzAwMDEwMTAxMDAwMDAwWhgPMDAwMTAxMDEwMDAwMDBaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRJDHlOnTBzi9kgiuc6aQnJYJjKSi62/CIDNPdieLb2DqrXnStuXwZjvfbXHwPQZM8K2P9wjaNdpg/pVTsxb0w5muZ4TepLEC7EUAG3BEmJorVCt2Na/uWtYP22eSV2wYoSNKWBtS0HRtHoMpyjxRDmYsbqBwZHW09nOr0AyADcEKC8aRoo4gB+zOIIrwUElx/a7LhmpgcSSAdJ0fSCk6FSYjC9SJY2uyyvVc4TrCeq1Luu+vJwD0F4IlLm3g8sLHzrijKX4YtGljp+ekY3EwwAc2dPe8q7e4+D3FaJ17BEzFn2x7jHq0jNfGlK5XK1gvqsjCB21HaO/Cb2v4b9C/bAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFidzXxftRXNdEJKDhkgLED2hnHvu+Eb2lobB/0qDW1S9Lu18iB7HzRxrrQS3A1NQYW93wnc7HiLVL6o3xNtUlmlOXIp1uznpqenVO+YiSFS9rJbgdZFtnQQZYdhJfcZj4ubFnoHg4r3PbOF3dRNdESccV5eNg6rEkbDkOXK6/s5gMaZZBlLv4StfosRudkF3bbgRo+kR6RkQZt9cI2fG1ppPic3sPYHe9m5SDieE3K5xe6w5xjmhSy9us/2gHjRo8Y9leYPkM3EoJkxruVfTfjkf0ZeL1hSi90hwG1nqhzFhg1IaIsIkW7Lm7ly4uKOR9H2hIzc6kuTtmJZx1NR91o="
      ],
      "x5tS256": "jN6QAO3bllpMyeZeQqkHsxxn90m_N_s4EKlNGdFaWqc="
    },
    {
      "alg": "RS256",
      "e": "AQAB",
      "key_ops": [
        "verify"
      ],
      "kid": "jwk-live-e070122d-68b5-4cd3-8b78-a653ea4b20c1",
      "kty": "RSA",
      "n": "vH_IoTlQBIYdvnrGNm8gau2a_Yzkg09CZf6mn9oyV3Kxqc0iXKozov8IZoH8hhaOTkxIb7oTd5iKh3b8HNLFzF-GPJH9WF8BaJP5iOxb8MuAVONRGEvL3kIYL7jHIVXclPWEekZ0GjUiz6BaL6NbsfKkN9tPSea_ktO3wbmNVtFN2iC0R9KUGITH-leJSbdus2TFKTRomJOpHKfMnKUEIG4NB4u1bXoZ1t9HHNWdRHslyADUBOjN1bXwVwn963EFX6fPo9melldpkR3w1aVLkdOQyD-ytS_dCjb9uhTvVS_t2Uvaz7PeFakJY9yT8yrGRjFA_oUEF3zdAWRQC5SDHQ",
      "use": "sig",
      "x5c": [
        "MIICfTCCAWWgAwIBAgIBATANBgkqhkiG9w0BAQsFADAAMCIYDzAwMDEwMTAxMDAwMDAwWhgPMDAwMTAxMDEwMDAwMDBaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8f8ihOVAEhh2+esY2byBq7Zr9jOSDT0Jl/qaf2jJXcrGpzSJcqjOi/whmgfyGFo5OTEhvuhN3mIqHdvwc0sXMX4Y8kf1YXwFok/mI7Fvwy4BU41EYS8veQhgvuMchVdyU9YR6RnQaNSLPoFovo1ux8qQ3209J5r+S07fBuY1W0U3aILRH0pQYhMf6V4lJt26zZMUpNGiYk6kcp8ycpQQgbg0Hi7VtehnW30cc1Z1EeyXIANQE6M3VtfBXCf3rcQVfp8+j2Z6WV2mRHfDVpUuR05DIP7K1L90KNv26FO9VL+3ZS9rPs94VqQlj3JPzKsZGMUD+hQQXfN0BZFALlIMdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAC+BPKqsEcx5aSzugyZLvEpm9zRLoNEs4D+CLMhWf+7EMKyZ9UfslIm8C/jZ+9DYEZ/dnioxh6glm7PcOKUO34TRuR7/3lqVm11bfwkqUFrmEBUxSyGnFXUOcojsvcynlS44HS0ROqtABxzr5YapzexB3ArGbbluVbOImoJjG2un2jjl4c/NfeWl0Bj80EYkljIt/wHovbosWPJ2qUc5eitfHhCxmF/1BPJpbSk24az9PFHq/LSiYkjYZFQS5Y6i5jdS1XI+aFGjuKkd+0Hc/RJ7kSMCOyB2KYYAfVL1+Ic99dETz2e/CWWepsFBcoqDswQYveA7Hc6Lrm4z1PMLOZg="
      ],
      "x5tS256": "fCivpRxEOApnkIJgdvGEdHwLkPe7h_7ffIg_X88ngaw="
    }
  ],
  "request_id": "request-id-live-6fe84be3-c3c8-4042-bf26-3ad4be88308a",
  "status_code": 200
}

this means that you’re using aggregate verifier but the code is not. It’s a config issue.
Can help better if login code is shared

No, I created a Custom verifier, not an Aggregate verifier

Please share the code snippets

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.