Question: I try to limit access to a REST API using a JWT token using the `validate-jwt` policy. Never did that before.

Here's my inbound policy (taken from the point **Simple token validation** [here](https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies?redirectedfrom=MSDN#ValidateJWT)):

```
<validate-jwt header-name="Authorization" require-scheme="Bearer">
    <issuer-signing-keys>
        <key>{{jwt-signing-key}}</key>
    </issuer-signing-keys>
    <audiences>
        <audience>CustomerNameNotDns</audience>
    </audiences>
    <issuers>
        <issuer>MyCompanyNameNotDns</issuer>
    </issuers>
</validate-jwt>

```

Using [this generator](http://jwtbuilder.jamiekurtz.com/) I created a claim (I'm not sure whether I understood issuer and audience correctly):

```
{
    "iss": "MyCompanyNameNotDns",
    "iat": 1572360380,
    "exp": 2361278784,
    "aud": "CustomerNameNotDns",
    "sub": "Auth"
}

```

In the section **Signed JSON Web Token** I picked **Generate 64-bit key** from the combo box. The key that was generated I put in the place of **{{jwt-signing-key}}**.

Now, I'm trying to call the API using Postman. I add an "Authorization" header, and as the value I put "Bearer {{ JWT created by the [linked generator](http://jwtbuilder.jamiekurtz.com/) }}".

I get 401, JWT not present. What am I doing wrong?

Answer: 
According to my research, If you use HS256 signing algorithms, the key must be provided inline within the policy in the base64 encoded form. In other words, we must encode the key as base64 string. For more details, please refer to the [document](https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT)
[![enter image description here](https://i.stack.imgur.com/ySPGw.png)](https://i.stack.imgur.com/ySPGw.png)

My test steps are as below

1. Create Jwt token
[![enter image description here](https://i.stack.imgur.com/6W6Vr.png)](https://i.stack.imgur.com/6W6Vr.png)
[![enter image description here](https://i.stack.imgur.com/i1etp.png)](https://i.stack.imgur.com/i1etp.png)
2. Test
a. If I directly provide the key in the policy, I get the 401 error
[![enter image description here](https://i.stack.imgur.com/xebIY.png)](https://i.stack.imgur.com/xebIY.png)

[![enter image description here](https://i.stack.imgur.com/6adLp.png)](https://i.stack.imgur.com/6adLp.png)

b. If I encode the key as base64 string in the policy, I can call the api
[![enter image description here](https://i.stack.imgur.com/3o9AB.png)](https://i.stack.imgur.com/3o9AB.png)
[![enter image description here](https://i.stack.imgur.com/h5fcM.png)](https://i.stack.imgur.com/h5fcM.png)
[Jim Xu's answer](https://stackoverflow.com/a/58620325/1693915) to encode the key as base64 string in the policy allowed me to get this far :-)

I set the **Ocp-Apim-Trace** parameter to true in order to debug it more closely. I followed the link provided in the response under **ocp-apim-trace-location**, and in the "on error" section I found the following message:

```
JWT Validation Failed: IDX10225: Lifetime validation failed. The token is missing an Expiration Time. Tokentype: 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken'..

```

Which is funny, because I have set the Expiration Time... to 2099. 

I changed it to a month from now and it worked just fine.