Skip to content

Conversation

@57hemanth
Copy link

This PR modifies JWT generation for GitHub App authentication to account for potential clock skew between the local machine and GitHub's servers.

Changes:

  • Updated generateJWT to subtract 60 seconds from the current time when setting the iat field.
  • Ensures the token is not considered "issued in the future" if local time is slightly ahead.
  • Keeps the exp value within GitHub’s required 10-minute maximum window.

Rationale:

In local development, JWT authentication was failing when the local machine’s clock was slightly ahead of GitHub's. This caused the GitHub API to reject the token as invalid. By subtracting 60 seconds from the iat value, we ensure reliable authentication without compromising security.

This adjustment follows the recommendation in GitHub’s official documentation on generating JWTs for a GitHub App, which uses the same offset to prevent clock-skew-related authentication failures. The example code provided in GitHub’s documentation, written in Ruby, demonstrates this approach.

Screenshot 2025-08-11 152541

References:

Fixes #744

@vercel
Copy link

vercel bot commented Aug 11, 2025

@57hemanth is attempting to deploy a commit to the LangChain Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

JWT authentication fails locally due to clock skew between server and client

1 participant