Could not deserialize key data on decoding JWT python

How did you encode your jwt? Use one of the approaches below

Encoding & Decoding Tokens with RS256 (RSA)

encoded = jwt.encode({'some': 'payload'}, private_key, algorithm='RS256')
decoded = jwt.decode(encoded, public_key, algorithms='RS256')

Reading the Claimset without Validation

jwt.decode(encoded, verify=False)
{u'some': u'payload'}

Or use same secret to encode and decode the jwt, one of the approach should work. In my case I used jwt.decode(token, verify=False) because my server has already did the signature validation for me, I only need to get the claimset.

Use the authlib library, I never managed to decode keycloak tokens with pyjwt.
You need a public_key, I assume you have it.

from authlib.jose import jwt
key = '-----BEGIN PUBLIC KEY-----n' + public_key + 'n-----END PUBLIC KEY-----'
key_binary = key.encode('ascii')

try:
    claims = jwt.decode(encoded,key_binary)
    claims.validate()
    #do some logic here
    #...

ProTip: you may grab the public key easily from your auth server (in my case Keycloak) at some endpoint:

url = 'http://localhost:8080/auth/realms/your_realm'
with  urllib.request.urlopen(url) as r:
    response = r.read()
    public_key = json.loads(response)['public_key']

It’s a good idea to use your RSA keys with OpenSSL:

openssl genrsa -out jwt-key 4096
openssl rsa -in jwt-key -pubout > jwt-key.pub

Reference: link

Updated Text:

It seems you’re encountering a key deserialization problem with the PyJWT library. This issue often arises from an incompatible or incorrectly formatted key. To resolve this, I suggest generating a new RSA key pair using OpenSSL. Here’s a step-by-step explanation:

1. Generating the RSA Private Key:

   • Command: openssl genrsa -out jwt-key 4096
   • This command uses OpenSSL to create an RSA private key.
   • genrsa generates the RSA key.
   • -out jwt-key defines the output filename for the private key.
   • 4096 is the key size, offering a balance between security and performance.

2. Extracting the Public Key:

   • Command: openssl rsa -in jwt-key -pubout > jwt-key.pub
   • This command extracts the public key from the generated private key.
   • -in jwt-key specifies the input file, the private key from the first step.
   • -pubout signals the extraction of the public key.
   • jwt-key.pub is where the public key will be saved.

By using these commands, you’ll generate a new RSA key pair. The private key (jwt-key) is for signing the JWT, and the public key (jwt-key.pub) is for verifying the signature. Remember to securely store the private key and only share the public key.

After generating these keys, update your Python code to use the new keys, ensuring the public key is read in the format expected by the PyJWT library. This approach should solve the deserialization issue with your current key.

If you get this error double check your public key is exactly right, new lines are important.

key = '''-----BEGIN PUBLIC KEY-----
<main key here>
-----END PUBLIC KEY-----'''

For me, there were spaces in the key (silly IDE) which caused this issue, make sure that’s not the case with you

MacOS Catalina 10.15.4 Python 2.7.16.

This solved the problem in my case

pip install cryptography==2.3

save the public key into the file and pass the path and use that.

1. public_key = open(path).read()
2. payload = jwt.decode(token,
   public_key, algorithms=[‘RS256’])

If the problem was the fact that you are using certificate you can just extract public / private key from the certificate:

from cryptography.x509 import load_pem_x509_certificate

cert_str = b"-----BEGIN CERTIFICATE-----MIIDETCCAfm..."
cert_obj = load_pem_x509_certificate(cert_str)
public_key = cert_obj.public_key()
private_key = cert_obj.private_key()

Source: https://pyjwt.readthedocs.io/en/stable/faq.html

For me what worked was setting the jwt verify signature to false:

import jwt 

token = st_javascript('''localStorage.getItem("some_token")''') # fetch your token of interest
decoded = jwt.decode(token, options={"verify_signature": False}) # decode the token

Note: This bypasses JWT verification and should only be used if you don’t care wether the JWT is cryptographically invalid or valid.

For more info you can view the jwt documentation.

For pyjwt 2.8.0, it worked for me when using options={"verify_signature": False} instead of verify=False

jwt.decode(token.encode(), options={"verify_signature": False})

If you have the JWKS url of your Authorization Server. Reference Use dynamic keys

from authlib.jose import jwt

response = requests.get('http://localhost:9090/oauth2/jwks')
response = response.json()
    
claims = jwt.decode(encoded, response)
print("claims validate:", claims.validate())
print("claims:", claims)

I tried manually passing the Public key to jwt.decode() and with pyjwt as well.