Azure IoT DPS设备注册时触发Malformed Token异常求助

I’ve run into this exact issue before when working with Azure IoT DPS—let’s walk through the most common fixes to get you back on track:

• Double-check your Provisioning Service Connection String
  This is the #1 culprit. You need to use the DPS service connection string (not an IoT Hub connection string or device connection string):

  1. Go to your DPS resource in the Azure portal
  2. Head to Shared access policies, pick a policy with EnrollmentWrite permissions (like iothubowner for testing)
  3. Copy the Primary connection string exactly—no extra spaces, quotes, or edits. Ensure your ServiceConnectionString variable in code matches this value perfectly.

• Remove accidental extra characters from the connection string
  It’s easy to grab leading/trailing spaces or quotation marks when copying. If you’re using a verbatim string in C# (@""), make sure you don’t have nested quotes, and if you’re using a regular string, escape any special characters properly.

• Verify your machine’s time synchronization
  SAS tokens (used under the hood by the ProvisioningServiceClient) are time-sensitive. If your local clock is off by more than 15 minutes from UTC, Azure will reject the token as invalid. Sync your system clock to a reliable time server and try again.

• Validate registration/device ID formatting
  While less likely to cause a malformed token error, invalid characters here can create unexpected issues. Stick to the rules:

  • Registration ID: Lowercase letters, numbers, hyphens only; starts with a letter/number; 1-128 characters
  • Device ID: Same rules as registration ID, plus periods are allowed

Quick code check: Ensure your connection string is set correctly like this:

private const string ServiceConnectionString = "HostName=your-dps-instance.azure-devices-provisioning.net;SharedAccessKeyName=iothubowner;SharedAccessKey=your-shared-access-key-value";

If none of these work, try stripping down your code to just the minimal setup (initialize the client and call the enrollment method) to rule out any other code interfering with the token generation.

内容的提问来源于stack exchange，提问作者kudlatiger