JWT 401 Error - Help Debugging

[Jason MacInnes]

Hello,

I am trying to make a request to a REST API endpoint via my Atlassian Connect Plugin. Whenever I make a request I get a 401 response code and an HTML response. 

Here's the current status and what I have tried.

• I have successfully installed the plugin and stored the security context information into the backend database. 
• My client key is a GUID
• My shared secret is a key like this: MIfFaJEz4w+wjhOI8cvjfskD/DottIUnlk6DPSHDFSI5ga1YE1hPMvSse8XqwLqkdc3HCZ2xFn2GCh4OzpoOVQ
• I am requesting READ scope and JWT authentication in my atlassian connect descriptor.
• I'm fairly certain that my JWT and QSH are correct because I have cross checked it against a couple of different OSS libraries.
• My JWT decode functions work just fine so that seems to imply my QSH generation, secret key, and ISS are correct.

I post a request like this:

GET /rest/api/2/status

Authorization: JWT <jwt>

Accept: application/json

Or like this:

GET /rest/api/2/user/search?username=%&includeInactive=true

Authorization: JWT <jwt>

Accept: application/json

What I get back is an HTML response with a 401 status code. There is no other detail in the HTML response as far as I can see. With cookie authentication these requests work and return JSON.

From what I can tell from reading this forum, I'm supposed to see a JSON error with details to help debug. Any ideas what I'm doing wrong?

Thanks,

Jason 

[Ayodele Akinbohun]

Thanks @Jason MacInnes for dropping an update on your fix. It really saved me a lot of trouble.

[Jason MacInnes]

I figured out my problem. I was using the value returned in the iss claim in the install hand shake as my iss claim when creating a JWT. However, in a request I was supposed to be using the  key specified in the "key" property from the Atlassian connect descriptor.