jwt not active Authentication Origin: Application & API Last updated 14 Oct 2026

NotBeforeError: jwt not active (nbf claim in the future)

The token’s nbf (not before) time is in the future for the verifying server — usually clock skew between servers.

Exact message you may see jwt not activeThe token is not yet valid (nbf)
Explore the map of this error Full error map →
Seen on: REST API

Meaning

If the issuer’s clock is ahead of the API server’s, freshly issued tokens look “not active yet”. Sync clocks (NTP) and allow a small clockTolerance.

Common causes

  • Clock skew between issuer and verifier
  • Container/VM clock drift
  • Token deliberately issued with future nbf

⚡ Quick fix

  1. Sync server clocks with NTP
  2. Set clockTolerance (e.g. 30 s) in verification
  3. Check nbf vs server time

Detailed fix by platform

JavaScript

  1. jwt.verify(token, key, { algorithms: ["RS256"], clockTolerance: 30 });

Linux

  1. bash
    timedatectl status
sudo timedatectl set-ntp true

How to diagnose

  1. Times — nbf vs server time (date -u)
  2. Clocks — NTP synced?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

Clock skew too great — Kerberos: Clock skew too great (KRB_AP_ERR_SKEW) (Authentication)Clock skew too greatinvalid algorithm — JWT error: invalid algorithm / The specified alg value is not allowed / jwt signature is required (Authentication)invalid algorithminvalid two-factor code — Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift) (Authentication)invalid two-factor co…invalid_token — invalid_token: The access token is invalid (JsonWebTokenError: invalid signature / jwt malformed) (Authentication)invalid_tokenjwt must be provided — JsonWebTokenError: jwt must be provided (Authentication)jwt must be providedsecretOrPrivateKey must have a value — Error: secretOrPrivateKey must have a value (jsonwebtoken sign) (Authentication)secretOrPrivateKey mu…TokenExpiredError — JWT Expired / Invalid Token (Authentication)TokenExpiredErrorjwt not a…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.