---
title: Runbook — AUTH_TOKEN_INVALID_SIGNATURE (서명 검증 실패)
category: AUTH
error_codes: [AUTH_TOKEN_INVALID_SIGNATURE]
severity: P1
owner: oncall
last_updated: 2026-06-15
status: stub
---

# Runbook: AUTH_TOKEN_INVALID_SIGNATURE (`runbook://auth/token-invalid-signature`)

## Symptoms

- HTTP 401 with `error.code=AUTH_TOKEN_INVALID_SIGNATURE`
- `log_level=ERROR` — may indicate forged tokens or wrong signing key

## Diagnosis

- Check if JWKS endpoint returned a new key set
- Check for token forgery attempts in logs

## Action

- Verify JWKS key IDs match token headers
- Alert security team if forgery suspected

## Escalation

- Immediate P1 escalation if forgery indicators present

---

> **Stub**: Phase D2 — author body after domain adoption. (feature-operational-runbook-contract D9)