This incident has been resolved. Please contact our customer support team at support@api.vonage.com if you have any further questions.
Posted Jun 28, 2023 - 19:11 UTC
Monitoring
We have implemented a fix for this issue.
The list of services that were impacted has been confirmed as: Messages API Voice API
Between 2023-06-27 08:10 UTC and 2023-06-28 14:00 UTC customers may have experienced authentication errors attempting to access our rest API's with improper JWT format. Customers who followed the standard format described in the JWT RFC: https://datatracker.ietf.org/doc/html/rfc7519 didn't get impacted.
We are temporarily allowing improperly formatted JWTs to allow customers time to adapt to the proper format. Please ensure to follow the JWT standard defined in the above RFC document to avoid any such issues in the future.
We will continue to monitor the service during the next few hours and post updates should anything change.
Posted Jun 28, 2023 - 16:55 UTC
Update
We are continuing to work on a fix for this issue, we are still looking at options to temporarily allow improper formatted JWTs, In the meantime, if you are experiencing this issue, please double-check your JWT against the standard. For example, ensure that if you're sending a Subject (sub field) it is a string, or if you're sending a unique identifier (jti field) it is also a string.
We will post further updates here.
Posted Jun 28, 2023 - 13:42 UTC
Identified
We have identified the root cause of the issue.
We have detected some cases of authentication JWTs that are being generated without following the standard format described in the JWT RFC: https://datatracker.ietf.org/doc/html/rfc7519. Due to a strengthening of the security checks, those JWTs were rightfully rejected as improperly formatted.
We are temporarily allowing improperly formatted JWTs to allow customers time to adapt to the proper format. We are looking at options for this. In the meantime, if you are experiencing this issue, please double-check your JWT against the standard. For example, ensure that if you're sending a Subject (sub field) it is a string, or if you're sending a unique identifier (jti field) it is also a string.
We will post further updates here.
Posted Jun 28, 2023 - 12:35 UTC
Investigating
Our monitoring has alerted us to a potential service issue with our platform. Customers may experience authentication errors attempting to access our rest APIs We are alerting customers immediately while our engineering teams investigate.
If there is a customer impact, it is likely to be affecting the following products: Voice API Messages API
We aim to provide an update on our investigation within 1 hour.