The token doesn't have a service instance.
Confirm a service instance is being passed in the token. To check whether the access token is structurally correct, you can use the tools available at jwt.io(link takes you to an external page).