# JWT App validation via cURL (PHP) results in 401

**URL:** <https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189>\
**Category:** JSM Cloud\
**Tags:** php, curl, jwt, jira-service-management\
**Created:** [July 2, 2019, 12:00pm UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189 "2019-07-02T12:00:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![WillemJellederNederl](https://avatars.discourse-cdn.com/v4/letter/w/a87d85/32.png) [@WillemJellederNederl](https://community.developer.atlassian.com/u/WillemJellederNederl)\
**Post date:** [July 2, 2019, 12:00pm UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189/1 "2019-07-02T12:00:34Z")

</div>

I am trying to create an application for Jira Service Desk, however, I keep getting stuck at the following point:  
After successfully generating a valid JWT, I try to access the rest URL via cURL, but I keep getting 401, unauthorized:

 ![image](https://global.discourse-cdn.com/atlassiandeveloper/original/3X/0/5/05b262e1f67392c82716750a0810653eb89520f9.png)

This is the function where I call the JWT-creature function:

```auto
public function generateJWT() {
    $j = new JWTModel();
    $o = new ObjectModel();
    $r = new RestModel();

    $object = $o->getClientByUrl('https://<my-instance-for-demo>.atlassian.net');
    $jwt = $j->generate(10000, $object->key, $object->clientKey, $object->sharedSecret);
    
    print_r($r->issueData($jwt, 10000));
}

```

This is the function that creates the JWT:

```auto
public function generate($issue, $key, $clientKey, $sharedSecret) {
    $token = [
        "iss" => $key,
        "iat" => time(),
        "exp" => time() * 3600,
        "sub" => $clientKey,
        "qsh" => hash('sha256', "GET&/rest/api/latest/issue/" . $issue)
    ];

    $jwt = JWT::encode($token, $sharedSecret);
    return $jwt;
}

```

And eventually the cURL-function:

```auto
public function issueData($jwt, $issue) {
    try {
        $curl = new Curl();
        $curl->setOpt(CURLOPT_SSL_VERIFYPEER, false);
        $curl->setOpt(CURLOPT_POST, false);
        $curl->setOpt(CURLOPT_HTTPHEADER, ['Authorization: JWT ' . $jwt, 'Content-type: application/json']);
        $curl->post("https://<my-instance-for-demo>.atlassian.net/rest/api/latest/issue/" . $issue);

        return $curl->response;
     } catch (\ErrorException $e) {
        return $e->getMessage();
     }
}

```

This is my connect:

```auto
{
  "name": "XXXX XXX",
  "description": "XXX makes your life easier",
  "key": "xxxx-app",
  "baseUrl": "https://xxx.xxxx.nl",
  "vendor": {
    "name": "xxxx",
    "url": "http://xxx.nl"
  },
  "links": {
    "self": "https://xxx.xxx.nl/atlassian-connect.json",
    "homepage": "https://xxx.nl/"
  },
  "authentication": {
    "type": "jwt"
  },
  "lifecycle": {
    "installed": "/installed",
    "uninstalled": "/unstalled"
  },
  "scopes": [
    "READ", "WRITE"
  ],
  "apiVersion": 1,
  "modules": {
    "webPanels": [{
      "conditions": [{
        "condition": "user_is_logged_in"
      }],
      "key": "xxx-xxx-insert",
      "name": {
        "value": "xxx"
      },
      "url": "/canned?project={servicedesk.serviceDeskId}&issueId={issue.id}&issueKey={issue.key}",
      "location": "atl.jira.view.issue.left.context",
      "layout": {
        "width": "100%",
        "height": "100px"
      },
      "weight": 999
    }]
  }
}

```

Does anyone sees the point where I made a mistake?

---

<div class="post-metadata">

**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\
**Post date:** [July 3, 2019, 6:27am UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189/2 "2019-07-03T06:27:42Z")

</div>

My first suggestion would be to check if the query string hash you generate is accurate. You can do so by using this tool: [JWT Decoder](http://jwt-decoder.herokuapp.com/jwt/decode). The hash for `GET&/rest/api/latest/issue/10000&` is `3a6df96de7b7c61eee6397e50530d7f4828fc3fcdd7727292e98e1b1016d0ecf`.

Once you’ve verified that this works, try making the request in Postman to see if the request itself (with the generated JWT) is valid. This will allow you to identify if the issue is with the request or with your cUrl code.

---

<div class="post-metadata">

**Author:** ![WillemJellederNederl](https://avatars.discourse-cdn.com/v4/letter/w/a87d85/32.png) [@WillemJellederNederl](https://community.developer.atlassian.com/u/WillemJellederNederl)\
**Post date:** [July 3, 2019, 6:44am UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189/3 "2019-07-03T06:44:10Z")

</div>

Hi Willem-Jelle,

Try using $curl-\>get() instead of $curl-\>post(). All the other code you wrote is good tho.

---

<div class="post-metadata">

**Author:** ![WillemJellederNederl](https://avatars.discourse-cdn.com/v4/letter/w/a87d85/32.png) [@WillemJellederNederl](https://community.developer.atlassian.com/u/WillemJellederNederl)\
**Post date:** [July 3, 2019, 6:45am UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189/4 "2019-07-03T06:45:19Z")

</div>

He Remie,

Thanks for your message! When testing, my JWT and type of connection was good all the time. The only thing I forgot, was changing the curl post to the curl get.

Such mistakes 🤒😩

---

<div class="post-metadata">

**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\
**Post date:** [July 3, 2019, 7:21am UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189/5 "2019-07-03T07:21:44Z")

</div>

😂 haha, well that is definitely something you can easily overlook

---

<div class="post-metadata">

**Author:** ![YatishMadhav](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/yatishmadhav/32/38979_2.png) [@YatishMadhav](https://community.developer.atlassian.com/u/YatishMadhav)\
**Post date:** [June 15, 2020, 7:57am UTC](https://community.developer.atlassian.com/t/jwt-app-validation-via-curl-php-results-in-401/30189/6 "2020-06-15T07:57:07Z")

</div>

I posted an update here as well [Solved: JWT App validation via cURL (PHP) results in 401](https://community.atlassian.com/t5/Jira-Service-Desk-questions/JWT-App-validation-via-cURL-PHP-results-in-401/qaq-p/1121806#U1405520)

But I noticed that expiry time should be time + 3600 - correct?

Also I am wondering if you can help me? I posted an update here too [I can't get JWT to work with PHP Rest Client - #6 by YatishMadhav](https://community.developer.atlassian.com/t/i-cant-get-jwt-to-work-with-php-rest-client/15495/6) - please have a look and let me know if there is something I am doing incorrectly?

Thank you in advance.