Getting 401 on AgentCore Gateway with Auth0 Inbound

Question

Hi,

I followed the https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html to create a test AgentCore gw with Auth0 as inbound auth. I used the python example code provided (with extra 'audience' in the req body) to get the access_token. The token looks good through https://www.jwt.io/ with the clientId, audience, expiration etc, also it's successful in the auth0 logging event.

But when I used that token to call the gw to call tools/list, it returns  401 '{"jsonrpc":"2.0","id":0,"error":{"code":-32001,"message":"Invalid Bearer token"}}'.

Anyone has suggestion where I should check or change?

Thanks

re:Post Agent · Answer

When you're receiving a 401 "Invalid Bearer token" error while trying to access your Amazon Bedrock AgentCore Gateway with Auth0 as your identity provider, there are several potential issues to check:

1. Verify that the `aud` (audience) claim in your JWT token exactly matches one of the audience entries you configured for the gateway's inbound authentication. For API Gateway to authorize a request, the JWT's `aud` or `client_id` claim must match one of the configured audience entries. Note that when both `aud` and `client_id` are present, the system evaluates `aud`.

2. Ensure you've correctly configured the discovery URL from your Auth0 directory. This URL helps AgentCore Identity retrieve the metadata related to your OAuth authorization server and token verification keys.

3. Check that you're including the token correctly in your request's Authorization header using the format: `Authorization: Bearer ${AccessToken}`.

4. Verify that the token hasn't expired. JWT tokens have an expiration time, and using an expired token will result in authentication failures.

5. Make sure the token was issued by the correct Auth0 tenant that you configured for the gateway.

6. Double-check that you've properly set up Auth0 as an inbound provider, including creating an API in Auth0, configuring API scopes, creating an application, and constructing the discovery URL correctly.

If you've verified all these aspects and are still experiencing issues, you might want to examine the CloudTrail logs for more detailed error information about the authentication failure.  
**Sources**  
[Auth0 by Okta - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity-idp-auth0.html)  
[Obtain an access token to make gateway requests - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-using-mcp-auth.html)  
[Setting up inbound Auth - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-inbound-auth.html)  
[Call a tool in a AgentCore gateway - Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-using-mcp-call.html)  
[Troubleshooting issues with HTTP API JWT authorizers - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-troubleshooting-jwt.html)

Getting 401 on AgentCore Gateway with Auth0 Inbound

Add your answer

Relevant content