[BUG] LongPort OpenAPI 401004 Token Invalid - JWT Signing Key Rotation Renders All Old Tokens Invalid

LongPort OpenAPI 401004 Token Invalid - JWT Signing Key Rotation Renders All Old Tokens Invalid

Problem Description

When using the Python SDK (longport 3.0.23) to connect to LongPort OpenAPI, all API calls return a 401004 token invalid error. The issue persists even after resetting the token via the console.

Environment

Steps to Reproduce

1. Obtain App Key, App Secret, and Access Token from https://open.longportapp.com/account
2. Initialize the SDK with:

   from longport.openapi import Config
   
   config = Config(
       app_key="xxx",
       app_secret="xxx", 
       access_token="m_eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ5YWRiMGIxYTdlNzYxNzEi..."
   )
   

3. Attempt to call any API (e.g., get account balance)
4. Error returned: 401004 token invalid

Error Details

SDK Error

401004, token invalid

HTTP API Detailed Error

Calling the HTTP API directly reveals a more detailed error message:

401102: token verification failed: public key not found for kid: d9adb0b1a7e76171

Key Findings

1. JWT Token is NOT expired: The token payload shows exp=1784557001 (2026-07-20), which is still valid
2. Signing key has been revoked: The public key corresponding to kid: d9adb0b1a7e76171 in the token header has been removed from the server
3. Reset Token does NOT help: After clicking "Reset Token" in the console, the newly generated token still uses kid: d9adb0b1a7e76171, meaning the signing key was not rotated, and the new token also fails verification
4. All auth methods fail: Config.from_env(), direct Config() instantiation, and refresh_access_token() all return 401004

Attempted Solutions

• Reset Access Token (new token still uses old kid — does not work)
• Initialize via Config.from_env() (still 401004)
• Use China mainland endpoint openapi.longportapp.cn (still 401004)
• Call HTTP API directly (returns detailed error: public key not found for kid)

Expected Behavior

1. Reset Token should issue a new token signed with the current valid signing key
2. Or provide a clear migration guide/tool for key rotation
3. Or provide a "Regenerate Application Credentials" option in the console that uses the new signing key

Related Issues

• #441 - Showing that my key has expired on the server
• #515 - LongBridge API 401004 error

The report concerns LongPort OpenAPI token verification and the Python SDK, but it does not identify an openapi-generator file, test, or entry point to change. Start by confirming whether LongPort authentication is generated or maintained in this repository; done would require an agreed repository-scoped fix or documentation for the signing-key rotation behavior.