Are you using nsecbunker? If so, your npub token policy may not include decrypt permission.