There are two possible causes: - the token is RS256 and not HS256 - your client domain/client id/client secret entered in the Graphcool integration panel does not match the client id/client domain in your app