Audience doesn't match

PyJWT (Python) — jwt.exceptions.InvalidAudienceError

What it means

The token has an `aud` claim and you passed `audience=` to `jwt.decode()`, but no value overlaps. PyJWT accepts the token when at least one of the token's audiences equals one of the audiences you allow; here none did. The signature was valid — the token was issued for a different recipient.

Why it happens

• The token was issued for another API

  common

  With one identity provider in front of several services, a client can easily send a token minted for service A to service B. Rejecting it is the purpose of the audience check.

• Different spelling of the same identifier

  common

  Exact string comparison: a trailing slash, `http` vs `https`, a client ID vs an API identifier URL, or upper-case letters all count as different audiences.

• An ID token reached the API

  occasional

  OpenID Connect ID tokens carry the client application's ID in `aud`. An API should receive access tokens issued for it; forwarding the ID token fails here.

How to fix it

1. 1.

   Compare the token's aud with your audience

   Decode without verification only to inspect, then verify with the exact identifier. Change the client's token request if the token was issued for the wrong audience; change the verifier if the identifier was misspelled.

   unverified = jwt.decode(token, options={"verify_signature": False})
   print(repr(unverified.get("aud")))  # str or list[str]
   
   claims = jwt.decode(
       token,
       signing_key,
       algorithms=["ES256"],
       audience="https://api.example.com/orders",  # must equal one of the token's aud values
       issuer="https://issuer.example.com/",
   )

2. 2.

   Allow multiple identifiers explicitly

   `audience` accepts a list. Use it when one API legitimately has several identifiers; never pass `options={"verify_aud": False}` to make the error disappear.

   # Any one of these may appear in the token's aud.
   claims = jwt.decode(token, signing_key, algorithms=["ES256"], audience=["orders-api", "https://api.example.com/orders"])

← Browse the full signature error database