이 오류는 JWT 디코딩 정책의 <Source> 요소에 지정된 JSON 웹 토큰(JWT)이 형식이 잘못되었거나 유효하지 않거나 분할할 수 없는 경우에 발생합니다.
올바르게 구조화된 JWT는 헤더, 페이로드, 서명이 header.payload.signature 형식이어야 합니다. DecodeJWT 정책에 전달된 JWT에 누락된 구성요소 부분이 있으면 오류가 발생합니다. 예를 들어 JWT에 payload.signature만 있고 header가 누락된 경우 오류가 발생합니다.
진단
JWT 디코딩 정책의 <Source> 요소에 지정된 변수를 식별합니다. 이 변수에는 JWT가 포함되어 있어야 합니다.
1단계에서 식별된 변수가 JWT 디코딩 정책이 실행되는 흐름에서 정의되었으며 사용 가능한지 확인합니다.
변수가 다음 중 하나인 경우
범위를 벗어난 경우(정책이 실행 중인 특정 흐름에서 사용할 수 없음)
확인할 수 없는 경우(정의되지 않음)
이는 오류의 원인이 됩니다.
아래의 API 요청 예에서 JWT는 사용자에 의한 승인 요청 헤더를 통해 전달되지 않습니다.
curl -v "http://$EXTERNAL_IP/v1/decodeJWT"
여기서 $EXTERNAL_IP는 외부 부하 분산기의 IP 주소입니다.
이 IP 주소가 인터넷에 노출됩니다. 자세한 내용은 액세스 라우팅 맞춤설정을 참조하세요.
Because the authorization request header is not passed, the Decode JWT policy fails with the error:
```
"faultstring": "Invalid token: policy({0})"
```
해결 방법
JWT 디코딩 정책의 <Source> 요소에서 참조되는 변수가 정의되었으며, 유효한(디코딩 가능한) JWT를 포함하고 있으며, JWT 디코딩 정책이 실행되는 특정 흐름에서 사용 가능한지 확인합니다.
위의 예시를 바로잡으려면 요청 승인 헤더에 유효한 JWT를 전달하면 됩니다. 이를 위해서는 다음과 같이 cURL 명령어를 사용하여 API를 호출하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eThis document provides troubleshooting guidance for common errors encountered with Apigee's Decode JWT policy, specifically \u003ccode\u003eFailedToDecode\u003c/code\u003e and \u003ccode\u003eInvalidToken\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eFailedToDecode\u003c/code\u003e error occurs when the JWT in the \u003ccode\u003e<Source>\u003c/code\u003e element is malformed or missing necessary components like the header, payload, or signature, which can be resolved by ensuring the JWT is correctly formatted as \u003ccode\u003eheader.payload.signature\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eInvalidToken\u003c/code\u003e error occurs if the variable specified in the \u003ccode\u003e<Source>\u003c/code\u003e element of the Decode JWT policy is out of scope or not defined, and can be resolved by ensuring a valid JWT is present in a defined variable.\u003c/p\u003e\n"],["\u003cp\u003eTo diagnose either error, identify the variable in the Decode JWT policy's \u003ccode\u003e<Source>\u003c/code\u003e element and check if it contains a valid, properly formatted, and decodable JWT.\u003c/p\u003e\n"],["\u003cp\u003eBoth of these errors can be corrected by passing a valid, properly formatted JWT (like \u003ccode\u003eheader.payload.signature\u003c/code\u003e) in the expected variable, such as the Authorization request header, as demonstrated in the provided cURL examples.\u003c/p\u003e\n"]]],[],null,["# Decode JWT runtime error troubleshooting\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nView [Apigee Edge](https://docs.apigee.com/api-platform/troubleshoot/policies/runtime/decode-JWT-runtime-errors) documentation.*\n| **Note:** Was this troubleshooting playbook helpful? Please let us know by clicking [Send Feedback]().\n\nFailedToDecode\n--------------\n\n### Error code\n\n steps.jwt.FailedToDecode\n\n### Error response body\n\n {\n \"fault\": {\n \"faultstring\": \"Failed to Decode Token: policy({0})\",\n \"detail\": {\n \"errorcode\": \"steps.jwt.FailedToDecode\"\n }\n }\n }\n\n### Cause\n\nThis error occurs if the [JSON Web Token](/apigee/docs/api-platform/reference/policies/jwt-policies-overview) (JWT) specified in the `\u003cSource\u003e` element of the Decode JWT policy is malformed, invalid or otherwise not decodable.\n\nA properly structured JWT should contain a header, payload and signature in the following format: `header.payload.signature`. If the JWT passed to the DecodeJWT policy is missing a component part, then you will get the error. For example, if the JWT has only `payload.signature`, but is missing its `header`, the error will occur.\n\n### Diagnosis\n\n1. Identify the variable specified in the `\u003cSource\u003e` element of the Decode JWT policy. This variable should contain the JWT.\n\n Here's a sample Decode JWT policy: \n\n \u003cDecodeJWT name=\"JWT-Decode-HS256\"\u003e\n \u003cDisplayName\u003eJWT Verify HS256\u003c/DisplayName\u003e\n \u003cSource\u003erequest.header.authorization\u003c/Source\u003e\n \u003cIgnoreUnresolvedVariables\u003efalse\u003c/IgnoreUnresolvedVariables\u003e\n \u003c/DecodeJWT\u003e\n\n In the above example, the JWT should be contained in the Authorization request header.\n2. Examine the variable identified in Step 1 and check to see if the JWT it contains is valid. If the input JWT is not valid, then that's the cause for the error.\n\n In the example API request below, the input JWT is passed in the Authorization request header: \n\n ```\n curl -v \"http://$EXTERNAL_IP/v1/decodeJWT\" -H \"Authorization: Bearer eyJ1c2VySWQiOiJiMDhmODZhZi0zNWRhLTQ4ZjItOGZhYi1jZWYzOTA0NjYwYmQifQ.-xN_h82PHVTCMA9vdoHrcZxH-x5mb11y1537t3rGzcM\"\n ```\n\n\n Where **$EXTERNAL_IP** is the IP address of the external load balancer.\n This IP address is exposed to the internet. For more information, see\n [Customize access routing](/apigee/docs/api-platform/get-started/configure-routing#external-access).\n\n \u003cbr /\u003e\n\n Close examination of the JWT shows that it has the format `payload.signature` which is invalid. The expected format of the JWT is `header.payload.signature`. As a result, the Decode JWT policy fails with the error : \n\n \"faultstring\": \"Failed to Decode Token: policy({0})\"\n\n### Resolution\n\nEnsure that the JWT passed to the Decode JWT policy contains all three elements, is correctly formatted and is decodable.\n\nTo correct the example shown above, you can pass in a valid JWT with the format `header.payload.signature`. This can be done by making the API call using the cURL command as follows: \n\n```\ncurl -v \"http://$EXTERNAL_IP/v1/decodeJWT\" -H \"Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJiMDhmODZhZi0zNWRhLTQ4ZjItOGZhYi1jZWYzOTA0NjYwYmQifQ.-xN_h82PHVTCMA9vdoHrcZxH-x5mb11y1537t3rGzcM\"\n```\n\n\nWhere **$EXTERNAL_IP** is the IP address of the external load balancer.\nThis IP address is exposed to the internet. For more information, see\n[Customize access routing](/apigee/docs/api-platform/get-started/configure-routing#external-access).\n\n\u003cbr /\u003e\n\nInvalidToken\n------------\n\n### Error code\n\n steps.jwt.InvalidToken\n\n### Error response body\n\n {\n \"fault\": {\n \"faultstring\": \"Invalid token: policy({0})\",\n \"detail\": {\n \"errorcode\": \"steps.jwt.InvalidToken\"\n }\n }\n }\n\n### Cause\n\nThis error occurs if the flow variable specified in the `\u003cSource\u003e` element of the Decode JWT policy is:\n\n- out of scope (not available in the specific flow where the policy is being executed) or\n- can't be resolved (is not defined)\n\n### Diagnosis\n\n1. Identify the variable specified in the `\u003cSource\u003e` element of the Decode JWT policy. This variable should contain the JWT.\n\n Here's a sample Decode JWT policy: \n\n \u003cDecodeJWT name=\"JWT-Decode-HS256\"\u003e\n \u003cDisplayName\u003eJWT Verify HS256\u003c/DisplayName\u003e\n \u003cSource\u003erequest.header.authorization\u003c/Source\u003e\n \u003cIgnoreUnresolvedVariables\u003efalse\u003c/IgnoreUnresolvedVariables\u003e\n \u003c/DecodeJWT\u003e\n\n In the example above, the Authorization request header should contain the JWT.\n2. Determine if the variable identified in Step 1 is defined and available in the flow in which the Decode JWT policy is executed.\n\n3. If the variable is either:\n\n - out of scope (not available in the specific flow where the policy is being executed) or\n - can't be resolved (is not defined)\n\n then that's the cause for the error.\n\n In the example API request below, the JWT is not passed in the authorization request header by the user. \n\n ```\n curl -v \"http://$EXTERNAL_IP/v1/decodeJWT\"\n ```\n\n\nWhere **$EXTERNAL_IP** is the IP address of the external load balancer.\nThis IP address is exposed to the internet. For more information, see\n[Customize access routing](/apigee/docs/api-platform/get-started/configure-routing#external-access).\n\n\u003cbr /\u003e\n\n Because the authorization request header is not passed, the Decode JWT policy fails with the error:\n\n ```\n \"faultstring\": \"Invalid token: policy({0})\"\n ```\n\n### Resolution\n\nEnsure that the variable referenced in the `\u003cSource\u003e` element of the Decode JWT policy is defined, contains a valid (decodable) JWT and is available in the specific flow where the Decode JWT policy is being executed.\n\nTo correct the example shown above, you can pass a valid JWT in the request authorization header. This can be done by making the API call using the cURL command as follows: \n\n```\ncurl -v \"http://$EXTERNAL_IP/v1/decodeJWT\" -H \"Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJiMDhmODZhZi0zNWRhLTQ4ZjItOGZhYi1jZWYzOTA0NjYwYmQifQ.-xN_h82PHVTCMA9vdoHrcZxH-x5mb11y1537t3rGzcM\"\n```\n\n\nWhere **$EXTERNAL_IP** is the IP address of the external load balancer.\nThis IP address is exposed to the internet. For more information, see\n[Customize access routing](/apigee/docs/api-platform/get-started/configure-routing#external-access).\n\n\u003cbr /\u003e"]]
