# X_OAUTH_TOKEN_INVALID

## Means

the id token failed its signature, issuer, audience or expiry check

## Typical cause

`As of 2026-08` the signature is verified too, against the issuer's published key set through a JWKS client — until this cycle the token was decoded and its claims read, so a token minted by whoever posted it to the callback passed every check it faced. Also: a token that is not a three-segment JWT, a payload with no `iss`/`sub`/`exp`/`aud`, a client id in `.env` that is not the one the authorize URL was built with, or a skewed host clock

## Fix

the `fix` branches on which check failed — for a signature, confirm the token came from the provider's token URL and was not minted by the caller; for the rest, match `<PROVIDER>_CLIENT_ID` to the id `beginOAuth()` used, then restart at `GET /auth/sso/<provider>`

[Auth and sessions](/error-codes#auth-and-sessions)