Everything worked on install day. Then the server rebooted — and now Nextcloud reports a token error and no document will open. Nothing was changed by anyone, and that is precisely the clue. This error has a very specific and very fixable cause.
JWT is the signature system the two servers use to prove they are talking to the real partner and not to a stranger. Every request between Nextcloud and the Document Server is signed with a shared secret. When the signatures stop matching, the Document Server protects itself and refuses — and you see a token error. There are only two ways that happens: the secret was typed differently on one side, or one side quietly generated a new secret by itself. The second one surprises everyone the first time.
Since OnlyOffice Docs version 7.2, if you start the container without setting your own JWT_SECRET, the container generates a random secret at startup. Restart the server or the container, and it generates a different random secret. Nextcloud, of course, still holds the old one in its connector settings. Nothing is broken and nothing was hacked — the two halves of the key simply no longer match, so every signed request is rejected.
The permanent fix is to own the secret. Recreate the container with an explicit secret of your choosing — a long random string you store in your password notes:
sudo docker run -i -t -d -p 80:80 --restart=always -e JWT_SECRET=your-own-secret-here -v /app/onlyoffice/logs:/var/log/onlyoffice -v /app/onlyoffice/data:/var/www/onlyoffice/Data -v /app/onlyoffice/lib:/var/lib/onlyoffice onlyoffice/documentserver
From now on, reboots and container restarts keep the same secret, because it comes from your command, not from a dice roll. You can confirm what a running container is using with sudo docker exec CONTAINER_ID printenv | grep JWT.
Now open Settings → ONLYOFFICE in Nextcloud and paste exactly that value into the Secret key field. Watch for the silent killers: a trailing space from copy-paste, a missing character, or an old different secret still sitting in the field. Save and let the connector run its connection test — it should pass immediately once both sides truly agree.
You will find advice online to set JWT_ENABLED=false and move on. Be honest about what that does: it removes the signature check entirely, so the Document Server will accept requests from anything that can reach it. On a completely private test network that trade-off may be acceptable for an afternoon of debugging. On any server reachable from the internet, it is leaving the door open to save ten minutes — set the matching secret instead.
Write the secret down where your team keeps infrastructure passwords, and note it in your setup documentation next to the server address. Every future event — a reinstall, a migration, an update that recreates the container — will need this value. The update guide on this site repeats the same warning: keep the secret identical across every container recreation and this error class simply stops existing in your life.
JWT_SECRET, use the identical string in the Nextcloud connector, and never let a container generate one for you again. A secret you control survives reboots — a generated one does not.
The full OnlyOffice Document Server install and Nextcloud integration, shown live step by step.
▶️ Watch Full VideoIf the container was started without an explicit JWT_SECRET, it generated a random secret at startup — and generated a new one at the next start. Nextcloud kept sending the old secret, so every signed request started failing. Setting your own JWT_SECRET and matching it in Nextcloud fixes it permanently.
Run sudo docker exec CONTAINER_ID printenv | grep JWT on the server to print the container's JWT environment values. Compare the secret with the one stored in Nextcloud under Settings, then ONLYOFFICE.
Disabling JWT removes the request signing that protects your Document Server, so anything that can reach it can ask it to process files. It is a debugging shortcut for a private test setup at best — the proper fix is always to make the two secrets match.