Q:

How does signing a token work? (Invalid Signature Error)

Background: I’m running integration tests inside a .NET Core Web API that uses Auth0 to authorize on my endpoints. My tokens coming back from Auth0 contain an “invalid signature” when I paste them into the JWT.io verifier.
I’m having some trouble understanding at which point in my Authorization flow that my token is being signed, who signs it, and how it is signed.
I started a new development API in Auth0 (“My Dev API”) that uses HS256 Signing Algo to sign my tokens. As I understand it, with HS256, there is one secret key that is used sign tokens (the signing secret), and the Machine to Machine flow looks like this:
I post some credentials to Auth0, like this:
clientID: exampleID
clientSecret: exampleSecret
audience: https://myaudience.com
grant_type: client_credentials

Auth0 sends me back an access token:
access_token: exampleToken1234

When I paste this token into JWT.io, I am told that the token has an invalid signature.
In my .NET application, I have some setup does some kind of configuration:
   static void AddAuthentication(IServiceCollection services)
       {
           services.AddAuthentication(options =>
           {
               options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
               options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    }).AddJwtBearer(options =>
        {
              options.TokenValidationParameters = new TokenValidationParameters
         {
               ValidIssuer = auth0Config.Domain,
               ValidAudience = auth0Config.Audience,
               IssuerSigningKey = new 
                        SymmetricSecurityKey(Encoding.UTF8.GetBytes(auth0Config.SigningSecret))
         };
     });
 }

Can anyone explain if I’m supposed to add code to sign this token, if it arrives already signed (and if so, why is JWT.io telling me there’s an invalid signature) and what the config above is actually doing?
Also, is it necessary to create a standalone Dev API or can I send autho requests to the pre-built management-api?
Thanks in advance!

A:

My tokens coming back from Auth0 contain an “invalid signature” when I paste them into the JWT.io verifier.

https://jwt.io can't verify the signature unless you paste the secret (that was used to sign token) into the field in the right column under "VERIFY SIGNATURE". So first paste the secret there, then paste the token into the left column. The order of is important!

I’m having some trouble understanding at which point in my Authorization flow that my token is being signed, who signs it, and how it is signed.

AuthO creates a signed token for you when the user is authenticated according to the presented credentials. To create a token first header and payload are created, then a signature is calculated as a hash of header and payload and secret. Read up on the basics here

Can anyone explain if I’m supposed to add code to sign this token, if it arrives already signed (and if so, why is JWT.io telling me there’s an invalid signature)

You don't need any additional signature, you get a signed token from AuthO. 

and what the config above is actually doing?

The config above tells your API that JWT based authentication is used and that incoming request should be checked for a valid JWT according to the configured parameters (validate issuer, audience and signature based on the values from auth0Config)

