JWT Bearer Token无效排查：PHP Curl请求返回401错误如何解决？

我正在排查代码无法正常运行的原因，当前逻辑是通过initAPI函数发起Curl请求获取access_token（调试确认JWT Token正确），但在bankIdVerify函数中携带该Token发起POST请求时，接口返回401错误：

{"status":401,"code":"token_invalid_not_a_jwt","title":"The provided bearer token is not a valid JWT","detail":"","traceId":"nHR4NMjtZ2lusq8bQRqNPlTF2CdQ2"}

用Postman发送相同请求能得到有效响应，请问哪里操作有误或遗漏了什么？

代码示例 #

function initAPI(){
    $ch = curl_init();

    curl_setopt($ch, CURLOPT_URL, "URL");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, "FIELDS");
    
    $headers = array();
    $headers[] = 'Content-Type: application/x-www-form-urlencoded';
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    
    $result = curl_exec($ch);
    if (curl_errno($ch)) {
        echo 'Error:' . curl_error($ch);
    }
    curl_close($ch);
    return $result;
 }

 $init_api_res = json_decode(initAPI());

 $access_token = $init_api_res->access_token;

 //print_r("[DEBUG] JWT: ".$access_token); //Outputting correct JWT

 function bankIdVerify() {
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, "URL");
    curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/json', 'Authorization: Bearer '. $access_token, 'Content-Type: application/json'));
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

    $data = <<<DATA
    {
        //i have removed this data for safety reason also it is not relevant.
    }
    DATA;

    curl_setopt($curl, CURLOPT_POSTFIELDS, $data);

    $resp = curl_exec($curl);
    curl_close($curl);

    return $resp;
 }

 print_r(bankIdVerify());

调试输出的JWT Token #

[DEBUG] JWT: eyJhbGciOiJSUzI1NiIsImtpZCI6InNhbmRib3gtc2lnbmluZy1rZXktN2ViNmZkNjhiMTk5YjA0M2FlY2I1ZGRjMzI0ZWYwZmQiLCJ0eXAiOiJhdCtqd3QifQ.eyJpc3MiOiJodHRwczovL2FwaS5zaWduaWNhdC5jb20vYXV0aC9vcGVuIiwibmJmIjoxNzA2ODc5MDEzLCJpYXQiOjE3MDY4NzkwMTMsImV4cCI6MTcwNjg3OTYxMywiYXVkIjoiaHR0cHM6Ly9hcGkuc2lnbmljYXQuY29tIiwic2NvcGUiOlsic2lnbmljYXQtYXBpIl0sImNsaWVudF9pZCI6InNhbmRib3gtZ3JpdHR5LWJ1Y2tldC04MTYiLCJhY2NvdW50X2lkIjoiYS1zcGdlLXI5eGpUV29nbk5adlJLSzJ6bW83Iiwic2FuZGJveCI6dHJ1ZSwianRpIjoiNDYyNzg4RDlBM0VEOTMzQTZBQjhFMEI0RDExQTgzMjQifQ.picqUqyxNppiYf6NQncxE2qsWJWS7-Ls8EPhQZGbiqJIP7Rr8RUPQTdKieRxjx_A1OZj6MfR885kAYSHxFrFvsqsFdouYZ0HdeS1USXpLw9aZn9ozZOpN7O8F4wIfZDjVQ0saDNHu7QQJC9q6f5C3gtXaMxzifJ8fc2Cv69CFgiyft1fCozvmvhjxuu61ZwgL6lAbNeS5dS4df7Yc4Wmxlj-pLDhHpmuVg_mK9c4lPMKik-qp6i3MsYbSBUkPGG8lUhO4vsnfFkIjh5UnwarVShasgO6g7CcvwNpz82zjrZyHFp7gXN0H7DbX11W5Xe4QQijjDEtf7Qccoji2r-gfA

核心问题是变量作用域：你在全局作用域定义的$access_token，在bankIdVerify函数内部无法直接访问，导致生成的Authorization头中没有携带有效的JWT Token，接口因此返回"token_invalid_not_a_jwt"错误。

两种解决方式：

1. 将Token作为参数传入函数（推荐，符合代码规范） #

修改bankIdVerify函数定义，添加参数接收$access_token，调用时传入该变量：

function bankIdVerify($access_token) {
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, "URL");
    // 这里使用传入的参数$access_token
    curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/json', 'Authorization: Bearer '. $access_token, 'Content-Type: application/json'));
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

    $data = <<<DATA
    {
        // 数据内容
    }
    DATA;

    curl_setopt($curl, CURLOPT_POSTFIELDS, $data);

    $resp = curl_exec($curl);
    curl_close($curl);

    return $resp;
 }

 // 调用时传入token
 print_r(bankIdVerify($access_token));

2. 在函数内部声明使用全局变量（不推荐，易引发维护问题） #

在bankIdVerify函数开头添加global $access_token，声明使用全局作用域的变量：

function bankIdVerify() {
    global $access_token; // 声明使用全局变量
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, "URL");
    curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/json', 'Authorization: Bearer '. $access_token, 'Content-Type: application/json'));
    // 后续代码不变
 }

额外调试建议 #

可以在bankIdVerify函数中输出实际生成的Authorization头，确认Token是否正确携带：

$authHeader = 'Authorization: Bearer '. $access_token;
var_dump($authHeader); // 查看实际生成的头内容，确认Token是否存在

内容的提问来源于stack exchange，提问作者TheTinniDev