oidc: expected audience "api-client" got ["web-client"]

coreos/go-oidc (Go) — IDTokenVerifier.Verify

What it means

The ID token is signed by the right provider, but its `aud` claim does not contain the `ClientID` you configured in `oidc.Config`. go-oidc implements the OpenID Connect rule that an ID token is only valid for the client it was issued to; the first quoted value is your `ClientID`, the list is the token's audiences.

Why it happens

• Another client's ID token was forwarded

  common

  A front end sends its ID token to a back-end API, which verifies it with the API's own client ID. ID tokens are meant for the client that requested them; APIs should receive access tokens.

• The configured client ID is wrong

  common

  Copying the client ID of another app registration or environment, or using the client secret's name instead of the ID. The token's `aud` shows the correct value.

• Verifying an access token as if it were an ID token

  occasional

  JWT access tokens carry the API's identifier in `aud`, not the client ID. `IDTokenVerifier` checks for the client ID by default, so access tokens fail unless you check the audience yourself.

How to fix it

1. 1.

   Use the client ID of the app that signed the user in

   For ID tokens, configure exactly the client ID the token was issued to.

   verifier := provider.Verifier(&oidc.Config{
   	ClientID: os.Getenv("OIDC_CLIENT_ID"), // the client the user signed in to; must equal the token's aud
   })
   idToken, err := verifier.Verify(ctx, rawIDToken)

2. 2.

   For API access tokens, check the API audience yourself

   `SkipClientIDCheck` only disables the built-in client-ID comparison. Replace it with an explicit check for your API's identifier — never skip audience validation altogether.

   // Verifying a JWT access token for an API: check signature/issuer/expiry here,
   // then check the API audience yourself.
   verifier := provider.Verifier(&oidc.Config{SkipClientIDCheck: true})
   tok, err := verifier.Verify(ctx, rawAccessToken)
   if err != nil {
   	return err
   }
   if !slices.Contains(tok.Audience, "https://api.example.com") {
   	return errors.New("token not issued for this API")
   }

← Browse the full signature error database