Power Pages

Portal auth token validation failed with the public key

(0) Share

Report

Posted on by shriramayushnvs

Hi, I created a self-signed certificate and added it in power platform admin center using the following commands:

$certificateName = "powerpages.yourdomain.com"

$certPassword = ConvertTo-SecureString -String 'YourStrongPassword123!' -Force -AsPlainText

$certificate = New-SelfSignedCertificate `

-Type Custom `

-CertStoreLocation "Cert:\CurrentUser\My" `

-DnsName $certificateName `

-Subject "CN=$certificateName" `

-KeyLength 2048 `

-KeyAlgorithm RSA `

-HashAlgorithm SHA256 `

-NotAfter (Get-Date).AddYears(5) `

-KeyExportPolicy Exportable `

-KeySpec Signature

Export-PfxCertificate `
    -Cert "Cert:\CurrentUser\My\$thumbprint" `
    -FilePath "C:\certificates\powerpages.pfx" `
    -Password $certPassword `
    -CryptoAlgorithmOption TripleDES_SHA1

But the generated token from '/_services/auth/token' failed the signature verification from the public key at '/_services/auth/publickey' when I checked on jwt.io website.

I am not sure, what am I doing wrong.

I found this thread which says, self-signed certificated can be used to call an external API.
https://community.powerplatform.com/forums/thread/details/?threadid=b28c273a-6550-4c9a-a603-39e59407fcb9

Any help would be appreciated.
Thanks

Categories:

General topics

I have the same question (0)

All responses (2)

Answers (0)

Sort by

Suggested answer

sannavajjala87 224 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!
Hi,

The issue is not with the Power Pages token service itself—it’s with the self-signed certificate you created. Here’s why:

Power Pages uses Azure Active Directory (AAD) and OpenID Connect for token signing.

The /auth/token endpoint issues tokens signed by Microsoft identity platform keys, not your custom certificate.

Adding a self-signed certificate in Power Platform Admin Center is for custom domain SSL binding, not for signing JWT tokens.

So, the public key at /auth/publickey will never match your self-signed certificate because the token is not signed with it.

How to Call External APIs Securely:

If your goal is to call an external API from Power Pages:

Use OAuth 2.0 or Azure AD App Registration

Register your external API in Azure AD.

Configure client credentials or delegated permissions.

Use Power Pages Web API or Liquid templates to acquire tokens.

Do NOT rely on self-signed cert for JWT

Instead, use Azure Key Vault or Managed Identity for secure secrets.

Was this reply helpful? Yes No
TO-21051152-1ax'+co... 2 Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

same thing happened to me

Was this reply helpful? Yes No