InvalidBearerTokenException: An error occurred while attempting to decode the Jwt

Q: Refresh the expired token

When to use: Use this if the error log specifically says 'Jwt expired'.. JWTs have an expiration time (exp claim). If the token is old, the backend will reject it. The frontend must use a refresh token to get a new access token.

Q: Ensure 'Bearer ' prefix is present

When to use: Use this if the token is valid but Spring Security still rejects it.. The OAuth2 Resource Server in Spring Security expects the header to start with 'Bearer ' (with a space). If you send just the token string, it fails.

Q: Verify the signing key matches

When to use: Use this if you generated the token with one secret key but the server is configured with another.. If the JWT signature doesn't match the server's secret key (or public key for RSA), Spring will reject it as invalid.

🔴 The Error You're Seeing

Confirm this matches your console output. If it does, you're in the right place.

ERROR LOG

2026-02-14 23:45:00.500  WARN 8842 --- [nio-8080-exec-9] o.s.s.web.util.matcher.OrRequestMatcher   : 

org.springframework.security.oauth2.jwt.JwtException: An error occurred while attempting to decode the Jwt: Jwt expired at 2026-02-14T22:00:00Z
	at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.decode(NimbusJwtDecoder.java:128)

⚡ Quick Fix Works 80% of the time

Ensure the client is sending a valid, non-expired JWT with the correct 'Bearer ' prefix in the Authorization header.

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZXZhIn0.abc123...

🛠️ Solutions (3 Ways to Fix)

Solution 1

Refresh the expired token

👉 Use this if the error log specifically says 'Jwt expired'.

JWTs have an expiration time (exp claim). If the token is old, the backend will reject it. The frontend must use a refresh token to get a new access token.

// Frontend logic:
// If API returns 401, call /api/auth/refresh to get a new token,
// then retry the original request.

Solution 2

Ensure 'Bearer ' prefix is present

👉 Use this if the token is valid but Spring Security still rejects it.

The OAuth2 Resource Server in Spring Security expects the header to start with 'Bearer ' (with a space). If you send just the token string, it fails.

// Correct HTTP Header
Authorization: Bearer <token>

// Incorrect
Authorization: <token>

Solution 3✓ Most common cause

Verify the signing key matches

👉 Use this if you generated the token with one secret key but the server is configured with another.

If the JWT signature doesn't match the server's secret key (or public key for RSA), Spring will reject it as invalid.

spring.security.oauth2.resourceserver.jwt.secret-key=${JWT_SECRET:my-super-secret-key}

📋 Version Notes

Spring Boot 2.x

Uses Spring Security OAuth 2 (deprecated). Often requires custom JWT filters.

Spring Boot 3.x

Uses Spring Security 6 OAuth2 Resource Server. Configured via SecurityFilterChain, no custom filter needed.

🧠 Why this Happens

Tap to expand the deep technical explanation

Spring Security intercepted the incoming HTTP request, extracted the JWT from the Authorization header, and passed it to the JwtDecoder. The decoder found the token to be invalid due to expiration, a bad signature, or malformed JSON.

The HITEC City Parking Spot Analogy:

It is like trying to enter a country with a passport. The immigration officer (Spring Security) checks the expiry date, the hologram (signature), and the data. If any of these are wrong, you are rejected at the border.

🛡️ How to Prevent This Next Time

Implement a robust token refresh mechanism in your frontend so users never experience expired token errors.