# Symptom
Token verification passes on the main web origin but 401s from a satellite domain, a preview deployment, or a mobile app, even though the same user is signed in everywhere.
# Confirm the cause
1. Decode the token payload without verifying and read the `azp` claim. That is the origin that minted the token.
2. Compare it to the `authorizedParties` you pass to `verifyToken` / `authenticateRequest`. The failing origin is missing from the list.
3. Check whether you recently added a new frontend (satellite domain, new subdomain, native scheme) without updating the list.
# Fix
- Add every origin that legitimately mints tokens to `authorizedParties`: your web origin, satellite domains, and native app identifiers.
- Do not "fix" this by dropping the check or widening it to everything. For cookie-based sessions this check is your CSRF protection.
# Verify
Sign in on each origin and confirm the backend accepts each token. Add a startup log that prints the configured authorized parties so the next new origin is obvious.