title: Google Analytics: Invalid JWT Signature (invalid_grant) when trying to make authorized API call
body: <p>I trying to make authorized API call (HTTP/REST) to service account in Google Analytics.
  using this doc: <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" rel="nofollow noreferrer">https://developers.google.com/identity/protocols/OAuth2ServiceAccount</a></p>
  
  <p>I just use HTTP/REST request to test.</p>
  
  <p>So I have service account's private key file:</p>
  
  <pre><code>{
    "type": "service_account",
    "project_id": "test-x",
    "private_key_id": "some_private_key_id",
    "private_key": "-----BEGIN PRIVATE KEY----- some_private_key -----END PRIVATE KEY-----",
    "client_email": "test-01@test-x.iam.gserviceaccount.com",
    "client_id": "some_client_id",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://accounts.google.com/o/oauth2/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/test-01%40test-x.iam.gserviceaccount.com"
  }
  </code></pre>
  
  <p>I create JWT based on
  client_email: 
  test-01@test-x.iam.gserviceaccount.com</p>
  
  <p>Header:</p>
  
  <pre><code>{"alg":"RS256","typ":"JWT"}
  </code></pre>
  
  <p>Claim set:</p>
  
  <pre><code>{
    "iss": "test-01@test-x.iam.gserviceaccount.com",
    "scope": "https://www.googleapis.com/auth/analytics.readonly",
    "aud": "https://www.googleapis.com/oauth2/v4/token",
    "exp": 1488820112,
    "iat": 1488816522
  }
  </code></pre>
  
  <p><strong>iat</strong> - I just set current</p>
  
  <p><strong>exp</strong> - current + 1 hour,</p>
  
  <p>I use this service to create signature: <a href="https://jwt.io/#debugger" rel="nofollow noreferrer">https://jwt.io/#debugger</a></p>
  
  <p>It generates encoded value which I try to use for access token request</p>
  
  <p>When I try to use generated result from "Encoded" field:</p>
  
  <pre><code>curl -d 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&amp;assertion=JWT_that_has_been_signed' https://www.googleapis.com/oauth2/v4/token
  </code></pre>
  
  <p>result:</p>
  
  <pre><code>{
   "error": "invalid_grant",
   "error_description": "Invalid JWT Signature."
  }
  </code></pre>
  
  <p>But I not use my private key.
  Accordingly to documentation for computing the signature I have to use my private key.
  I not completely understand how to use key in right way to compute the signature correctly.</p>
  
  <p>jwt.io already generates PUBLIC and PRIVATE key...</p>
  
  <p>Probably I'm using jwt.io incorrectly..</p>
  
  <p>Please advise me the correct way of creating JWT or may be another service to create it.</p>
  
  <p>Thanks!</p>