bug: ERR_JWT_CLAIM_VALIDATION_FAILED when calling api endpoint about logto HOT 5 CLOSED

thank you for your help, I've deleted the db docker image and recreated it from scratch with a fresh set of config, and succeeded with calling the API :)

from logto.

Hi @dadvir , have you create an application role with the Management API permission (all)? And when you trying to fetch the access token, remember to use the all as the scope param value.

Create an M2M application

Create an applicaiton role with the Management API permission

Assign the role above to your M2M App

Request access token with all scope and the management api resource

curl --location '[your-logto-endpoing]/oidc/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic ${generateBasicAuth(m2mAppId, m2mAppSecret)}' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'resource=https://[your-tenant-id].logto.app/api' \
--data-urlencode 'scope=all'

from logto.

Thank you for the quick response :)

I've tried these again and got to the same issue, please see attached screen shots of the config and outcome.

The application:

Its roles:

The API with role (too.. didn't see this on your end, but saw it in the getting started guide...):

The role with all access:

And the machine-to-machine access:

from logto.

@xiaoyijun I've created another app and followed your instructions again, with a "fresh" app, and got the same result.
your help will be highly appreciated here :)

from logto.

@dadvir You have setup the app correctly, maybe the error is because you're using the m2m app in a wrong way.
Here is what i did:

Step 1: Request an access token from Logto core service by the M2M app

Code snippet:

curl --location 'http://localhost:3001/oidc/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic OWxydTU5ZG91NzF1bDl0YXJkYTZ3OktEQ29oOGxNNllWVkFSVDM1cjdJWGI5ZlF6azZhcTVU' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=all' \
--data-urlencode 'resource=https://default.logto.app/api'

And you will get the access token:

Step 2: Fetch application data using the access token

Code snippet:

curl --location 'http://localhost:3001/api/applications' \
--header 'Authorization: Bearer eyJh[Hide for brevity]-fUU'

Logto Console configuration

from logto.