# Error 401 in our JIRA App while we're actually authenticated

**URL:** <https://community.developer.atlassian.com/t/error-401-in-our-jira-app-while-were-actually-authenticated/48891>\
**Category:** Jira Cloud\
**Tags:** auth, jwt, atlassian-connect\
**Created:** [June 14, 2021, 1:31pm UTC](https://community.developer.atlassian.com/t/error-401-in-our-jira-app-while-were-actually-authenticated/48891 "2021-06-14T13:31:57Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![matthias1](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@matthias1](https://community.developer.atlassian.com/u/matthias1)\
**Post date:** [June 26, 2021, 8:57am UTC](https://community.developer.atlassian.com/t/error-401-in-our-jira-app-while-were-actually-authenticated/48891/3 "2021-06-26T08:57:06Z")

</div>

Hi @bentley,  
thanks for the link, but after reading into it I don’t think this is related to our problem: we do not generate the JWT token ourselves - it’s all handled by ACSB.  
In fact, the add-on was working perfectly until we upgraded to ACSB 2.1.5 and applied the changes required [by this announcement](https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072?utm_source=alert-email&utm_medium=email&utm_campaign=vulnerability-api-change_EML-10294&jobid=105040724&subid=1523028824).  
What’s puzzling me, is that the user can access the configuration page, so s/he must be authenticated somehow. It’s only when the POST call to update the configuration is sent that the error occurs.  
Any ideas?

---

_[View the full topic](https://community.developer.atlassian.com/t/error-401-in-our-jira-app-while-were-actually-authenticated/48891)._