Developer track
What the gateway rejects
NAVI's edge is strict by design — it's what keeps one tenant's users out of another's data. If integration "doesn't work," it's almost always one of these. All are enforced before any request reaches your instance.
| Symptom | Cause | Fix |
|---|---|---|
| 401 / rejected token | Wrong algorithm — the gateway is locked to RS256 and refuses none or HMAC. |
Sign with RS256 and your private key. |
| 401 after a short while | Token expired (exp passed). |
Mint per page load; keep TTL ≤ 10 min; don't cache tokens. |
| 401 on a reused token | Replay — the same jti was seen before. |
Generate a fresh jti for every token. |
| 401 issuer/audience | iss or aud don't match what's registered. |
Match iss to your instance; set aud to navi. |
| Signature invalid | Public key in the Portal doesn't match your signing key. | Re-upload the matching public key under Security Keys. |
| Widget blank / postMessage blocked | Embedding origin not allowed. | Add the exact origin under CORS & Origins. |