3685691 - OAuth2 JWT Tokens is invalid after server restart

In the SAP Commerce 2211 for JDK 21 (local env) , after a server restart, all previously issued OAuth2 access tokens stop working. Clients receive HTTP 401 Unauthorized responses when calling protected APIs with tokens that were valid before the restart. The issue occurs consistently on every pod restart and affects all token types issued via the Authorization Code flow, Client Credentials flow, and Refresh Token flow.

Error response observed on the Resource Server side:

{"error_code":"invalid_token","error_description":"An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found"}

No token revocation events are logged. The tokens have not expired based on their configured TTL.

• SAP Commerce 2211 for JDK21

OAuth2, access token, invalid token, 401 Unauthorized, pod restart, server restart, JWT signature, DefaultJwkSource, token validation, Authorization Server, key rotation , KBA , CEC-SCC-PLA-PL , Platform , Problem