token/key pair verification work in the JWT.io debugger but not with node-jsonwbetoken

This is very strange.

See Runkit. Also pasting here. IS there some step in the debugger that I am not doing in this test code?

https://runkit.com/owendall/5bc28965f7b84200120e6f04

var jwt = require("jsonwebtoken")

// HS256 
var token='eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL3RvcGl4LmF1dGgwLmNvbS8iLCJzdWIiOiJhdXRoMHw1YmJjZmVhYjY4YTU2YzRjNTEzMjIyM2MiLCJhdWQiOlsiaHR0cHM6Ly90b3BpeC5pby90ZXN0Il0sImlhdCI6MTUzOTQ3NTQ5NSwiZXhwIjoxNTM5NDgyNjk1LCJhenAiOiJTaWNWUUlQRFJqQ2t2WVFFaTQ2bFNJWFhUeVllc1RJWCIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUifQ.p9VPXiKqD4zFcKAoq112dV3FIyoHncAi0UytOJaPs2c';

// This is the "Signing Secret" obtained from Auth0 for the test API
var key = 'cE9d0Vy07dFxD3SOnpiAYLwwkDno7ZB6';// This is the same key used in the JWT.io debugger that works there!!

// Sync version: First try without specifying alg
try {
 var decoded = jwt.verify(token, key)
} catch(err){
  console.log("Verify: Sync test 1: " +err.message);
}

try {
 var decoded = jwt.verify(token, key, { algorithms: ['HS256'] })
} catch(err){
  console.log("Verify: Sync test 2: " +err.message);
}

// Try async version
jwt.verify(token, key, function(err, decoded) {
  if (!err) {
  console.log('Verify: Async test 1: Audience decoded: ' +decoded.aud)
  } else {
  console.log("Verify: Async test 1: "+ err.message);
  }
});

// Now just decode without signature verification
try {
  var decoded = jwt.decode(token,key);
  console.log('Decode Only: Sync test: Audience decoded: '+ decoded.aud);
} catch(err){
  console.log(err.message);
}

[danielransome]

@MitMaro Thanks, this old comment of yours helped me out today, I thought my signature was OK when testing with JWT.io - terrible design which really threw me off the scent!

[MitMaro]

I’ve been bitten by that particular “feature” of jwt.io in the past. Good luck with your investigation!