diff --git a/security/jwt/src/main/java/io/helidon/security/jwt/JwtUtil.java b/security/jwt/src/main/java/io/helidon/security/jwt/JwtUtil.java
index 67a684af2de..1b3eb631228 100644
--- a/security/jwt/src/main/java/io/helidon/security/jwt/JwtUtil.java
+++ b/security/jwt/src/main/java/io/helidon/security/jwt/JwtUtil.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
+ * Copyright (c) 2018, 2022 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,6 +42,7 @@
 import javax.crypto.Mac;
 
 import jakarta.json.Json;
+import jakarta.json.JsonArray;
 import jakarta.json.JsonBuilderFactory;
 import jakarta.json.JsonNumber;
 import jakarta.json.JsonObject;
@@ -309,8 +310,12 @@ static Optional<Address> toAddress(JsonObject json, String name) {
     }
 
     static Optional<List<String>> toScopes(JsonObject json) {
-        return getString(json, "scope")
-                .map(it -> Arrays.asList(it.split(" ")));
+        if (json.get("scope") instanceof JsonArray) {
+            return getStrings(json, "scope");
+        } else {
+            return getString(json, "scope")
+                    .map(it -> Arrays.asList(it.split(" ")));
+        }
     }
 
     static Optional<ZoneId> toTimeZone(JsonObject json, String name) {