Could not deserialize key data on decoding JWT python

If you get this error double check your public key is exactly right, new lines are important.

key = '''-----BEGIN PUBLIC KEY-----
<main key here>
-----END PUBLIC KEY-----'''

It's a good idea to use your RSA keys with OpenSSL:

openssl genrsa -out jwt-key 4096
openssl rsa -in jwt-key -pubout > jwt-key.pub

Reference: link

Updated Text:

It seems you're encountering a key deserialization problem with the PyJWT library. This issue often arises from an incompatible or incorrectly formatted key. To resolve this, I suggest generating a new RSA key pair using OpenSSL. Here's a step-by-step explanation:

1. Generating the RSA Private Key:

   • Command: openssl genrsa -out jwt-key 4096
   • This command uses OpenSSL to create an RSA private key.
   • genrsa generates the RSA key.
   • -out jwt-key defines the output filename for the private key.
   • 4096 is the key size, offering a balance between security and performance.

2. Extracting the Public Key:

   • Command: openssl rsa -in jwt-key -pubout > jwt-key.pub
   • This command extracts the public key from the generated private key.
   • -in jwt-key specifies the input file, the private key from the first step.
   • -pubout signals the extraction of the public key.
   • jwt-key.pub is where the public key will be saved.

By using these commands, you'll generate a new RSA key pair. The private key (jwt-key) is for signing the JWT, and the public key (jwt-key.pub) is for verifying the signature. Remember to securely store the private key and only share the public key.

After generating these keys, update your Python code to use the new keys, ensuring the public key is read in the format expected by the PyJWT library. This approach should solve the deserialization issue with your current key.

Use the authlib library, I never managed to decode keycloak tokens with pyjwt. You need a public_key, I assume you have it.

from authlib.jose import jwt
key = '-----BEGIN PUBLIC KEY-----\n' + public_key + '\n-----END PUBLIC KEY-----'
key_binary = key.encode('ascii')

try:
    claims = jwt.decode(encoded,key_binary)
    claims.validate()
    #do some logic here
    #...

ProTip: you may grab the public key easily from your auth server (in my case Keycloak) at some endpoint:

url = 'http://localhost:8080/auth/realms/your_realm'
with  urllib.request.urlopen(url) as r:
    response = r.read()
    public_key = json.loads(response)['public_key']

How did you encode your jwt? Use one of the approaches below

Encoding & Decoding Tokens with RS256 (RSA)

encoded = jwt.encode({'some': 'payload'}, private_key, algorithm='RS256')
decoded = jwt.decode(encoded, public_key, algorithms='RS256')

Reading the Claimset without Validation

jwt.decode(encoded, verify=False)
{u'some': u'payload'}

Or use same secret to encode and decode the jwt, one of the approach should work. In my case I used jwt.decode(token, verify=False) because my server has already did the signature validation for me, I only need to get the claimset.

For pyjwt 2.8.0, it worked for me when using options={"verify_signature": False} instead of verify=False

jwt.decode(token.encode(), options={"verify_signature": False})

MacOS Catalina 10.15.4 Python 2.7.16.

This solved the problem in my case

pip install cryptography==2.3

If the problem was the fact that you are using certificate you can just extract public / private key from the certificate:

from cryptography.x509 import load_pem_x509_certificate

cert_str = b"-----BEGIN CERTIFICATE-----MIIDETCCAfm..."
cert_obj = load_pem_x509_certificate(cert_str)
public_key = cert_obj.public_key()
private_key = cert_obj.private_key()

Source: https://pyjwt.readthedocs.io/en/stable/faq.html

For me, there were spaces in the key (silly IDE) which caused this issue, make sure that's not the case with you

save the public key into the file and pass the path and use that.

1. public_key = open(path).read()
2. payload = jwt.decode(token, public_key, algorithms=['RS256'])

For me what worked was setting the jwt verify signature to false:

import jwt 

token = st_javascript('''localStorage.getItem("some_token")''') # fetch your token of interest
decoded = jwt.decode(token, options={"verify_signature": False}) # decode the token

Note: This bypasses JWT verification and should only be used if you don't care wether the JWT is cryptographically invalid or valid.

For more info you can view the jwt documentation.

If you have the JWKS url of your Authorization Server. Reference Use dynamic keys

from authlib.jose import jwt

response = requests.get('http://localhost:9090/oauth2/jwks')
response = response.json()
    
claims = jwt.decode(encoded, response)
print("claims validate:", claims.validate())
print("claims:", claims)

I tried manually passing the Public key to jwt.decode() and with pyjwt as well.

You have to escape the \n characters:

# Replace \n with actual newlines
api_secret = api_secret.replace("\\n", "\n")

print(f"API Key: {api_key}")
print(f"API Secret: {api_secret}")

I am stumbled upon this problem today for creating the JWT for Google Wallet Service and all the examples here are not complete so I have written this piece of code and it works on my side.

import jwt
import time

iat = time.time()
exp = iat + 3600

secret='''-----BEGIN PRIVATE KEY-----
PASTE HERE THE PRIVATE KEY FROM THE CREDENTIALS.JSON FILE DOWNLOADED FROM GOOGLE CLOUD
-----END PRIVATE KEY-----'''


payload = {
  "iss": "[email protected]",
  "sub": "[email protected]",
  "aud": "https://walletobjects.googleapis.com/",
  "iat": iat,
  "exp": exp
 }
           
additional_headers = {'kid': 'YOUR PRIVATE KEY ID'}
signed_jwt = jwt.encode(payload, secret, headers=additional_headers,
                       algorithm='RS256')
                       
print(signed_jwt)

Remember to execute the code by shell:

python nameofyourfile