GitHub API returns 401 while trying to generate access token

Question

I'm trying to generate an access token for my GitHub App via GitHub API.

I'm getting a 401 unauthorized response error:

expiration time' claim ('exp') is too far in the future

My code:

const now = Date.now()
const expiration = now + 60 * 10 // JWT expiration time (10 minute maximum)

const payload = {
  iat: now
  exp: expiration,
  iss: appId
}

const jwt = jwtGenerator(payload, privatePem, { algorithm: "RS256" })

Github documentation - https://developer.github.com/apps/building-github-apps/authenticating-with-github-apps/

"jsonwebtoken": "^8.5.1". jwtGenerator its just a function which wrap the sign function of jsonwebtoken — Shahar Yakov
– Shahar Yakov, Commented May 13, 2020 at 10:55

Shahar Yakov · Accepted Answer · 2020-05-18 15:18:52Z

3

I figured out what was the problem.

The times on different machine were not in sync. To solve that I set the iat time 30 secs in the past (I tried different time span but it turned out that 30 sec works the best).

const now = Math.floor(Date.now() / 1000) - 30
const expiration = now + 60 * 10 // JWT expiration time (10 minute maximum)

const payload = {
  iat: now,
  exp: expiration,
  iss: appId
}

const jwt = jwtGenerator(payload, privatePem, { algorithm: "RS256" })

answered May 18, 2020 at 15:18

Shahar Yakov

4263 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

nitishagar · Accepted Answer · 2020-05-13 18:21:54Z

0

Github might be expecting an epoch time in seconds under exp. If you look at the ruby example they use Time.now.to_i which returns an epoch time in seconds. Javascript's Date.now() returns an epoch time in milliseconds which is too large, you should try dividing Date.now() by 1000, for example:

const now = (Date.now() / 1000)
const expiration = now  + (60 * 10) // JWT expiration time (10 minute maximum)

const payload = {
  iat: now
  exp: expiration,
  iss: appId
}

const jwt = jwtGenerator(payload, privatePem, { algorithm: "RS256" })

The documentation for jsonwebtoken specifically mentions:

IEEE Std 1003.1, 2013 Edition [POSIX.1] definition "Seconds Since the Epoch"

Using divide by 1000 and Math.floor for proper integer conversion - I was able to get GithubAPI to work with the jwt.sign.

edited May 13, 2020 at 18:21

nitishagar

9,4213 gold badges32 silver badges41 bronze badges

answered May 13, 2020 at 10:01

Rewire

3612 silver badges9 bronze badges

1 Comment

Shahar Yakov Over a year ago

good idea, I tried this also, but it seems like this is not the problem, they are working with both formats

Collectives™ on Stack Overflow

GitHub API returns 401 while trying to generate access token

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related