jwt audience invalid. expected: <audience>

The placeholder is filled with your configured value, e.g. "jwt audience invalid. expected: api://orders".

What it means

The token verified cryptographically, but its aud claim does not match the audience your verifier requires. Audience checking exists so a token minted for one API cannot be replayed against another — the signature proves who issued the token, while aud proves which service it was issued for, and both checks must pass before the claims can be trusted.

Why it happens

• Exact-match mismatch in the identifier

  common

  aud comparison is string-exact. "https://api.example.com" vs "https://api.example.com/" (trailing slash), http vs https, or a client ID vs an API identifier — any of these fails. OAuth providers often put the client_id in aud unless you request a specific audience.

• The token was minted for a different API

  common

  The client obtained a token for service A and sent it to service B. Common with one identity provider serving several APIs: the audience parameter in the token request must name the API the token will be presented to.

• aud is an array and expectations differ

  occasional

  aud may legally be an array of strings. jsonwebtoken matches if any element equals any expected value — but code that pre-validates aud manually, assuming a plain string, breaks on array-valued claims.

How to fix it

1. 1.

   Compare what the token carries with what you expect

   Print both sides. Fix whichever is wrong: the verifier's audience option, or the audience/resource parameter the client uses when requesting the token.

   const { aud } = jwt.decode(token);
   console.log("token aud:", aud);           // e.g. "api://orders" or ["api://orders"]
   jwt.verify(token, key, {
     algorithms: ["ES256"],
     audience: "api://orders",              // must match exactly (string, array or RegExp)
   });

2. 2.

   Accept legitimate variants explicitly

   If several identifiers are genuinely valid for this API, list them — do not drop the audience check to make the error go away.

   jwt.verify(token, key, {
     algorithms: ["ES256"],
     audience: ["api://orders", "https://api.example.com"],
   });

← Browse the full signature error database