# Symptom
`verifyToken` or `authenticateRequest` returns 401 ("Token not verified") for a user who is visibly signed in on the frontend.
# Confirm the cause
1. Figure out which verifier you call. `authenticateRequest` is networkless only when you pass `jwtKey` (the JWKS public key from the dashboard). Without it, the SDK makes a network call to fetch the JWKS; blocked egress or a stale cache then looks like a bad token.
2. If you pass `jwtKey`, confirm it is the CURRENT public key for THIS instance. Keys copied long ago, or copied from a different instance, fail signature verification silently.
3. Decode the token header (base64, no verification needed) and compare its `kid` to the key your backend uses. A mismatch after a key rotation is the classic cause.
4. Make sure you are not verifying a JWT-template token as a session token (or the reverse). Template tokens carry different claims and issuers.
# Fix
- Re-copy the JWKS public key from the dashboard into your `jwtKey` config and redeploy.
- If you fetch the JWKS over the network, clear the cached keys and let the SDK refetch.
- Always pass `authorizedParties` with your real origins alongside the key (see the azp skill).
# Verify
Sign in on the frontend, then call the backend with the fresh session token. It must verify. Repeat after a redeploy to make sure the key is not baked into a stale build artifact.