title: Why do I get SecurityTokenSignatureKeyNotFoundException?
body: <p>When I try to pass this JWT (issued by Azure Mobile Services) as a HTTP header/Authorization/Bearer token:</p>
  
  <pre><code>Header:
  {
      "alg": "HS256", 
      "typ": "JWT", 
      "kid": "0"
  }
  Claims:
  {
      "ver": 2, 
      "aud": "Facebook", 
      "iss": "urn:microsoft:windows-azure:zumo", 
      "urn:microsoft:credentials": "pYK8b5...", 
      "exp": 1436730730, 
      "uid": "Facebook:10000xxxxxxxxxx"
  }
  </code></pre>
  
  <p>Into my ASP.NET WEB API configured:</p>
  
  <pre><code>const string issuer = "urn:microsoft:windows-azure:zumo";
  byte[] mobileServicesSecret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["as:SecretKey"]);
  
  app.UseJwtBearerAuthentication(
      new JwtBearerAuthenticationOptions
      {
        AuthenticationMode = AuthenticationMode.Active,
        AllowedAudiences = new[] { "Facebook" },
        IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                {
                    new SymmetricKeyIssuerSecurityTokenProvider(issuer,  mobileServicesSecret)
                }
      });
  </code></pre>
  
  <p>I get:</p>
  
  <blockquote>
    <p>A first chance exception of type
    'System.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException'
    occurred in System.IdentityModel.Tokens.Jwt.dll</p>
  </blockquote>
  
  <p>I suspect this is because the presence of the "kid" property?</p>
  
  <p>EDIT: Using this <a href="https://github.com/Magenic/JWTvalidator/tree/master/JwtValidator/JwtValidator" rel="nofollow">https://github.com/Magenic/JWTvalidator/tree/master/JwtValidator/JwtValidator</a>  , it's possible to validate the JWT, so it's nothing wrong with it. But I really want to use OWIN/Katana.</p>