Our QA sandbox refreshed and now the client app that communicates via a connected app using JWT flow is getting a bearer token and getting a 401. I always thought that once you have a bearer token that it is valid. The client app bearer token shared with me gives a 'Invalid Signature' when I verify on JWT.IO.
Could this be because the client app folks need to update their certificate?
I checked the integration user associated with the client app and they seem to have the right permissions.