Invalid audience

Compare with "Audience doesn't match", which means you did pass `audience` but no value overlapped.

PyJWT (Python) — jwt.exceptions.InvalidAudienceError

What it means

The token contains an `aud` claim, but `jwt.decode()` was called without an `audience` argument. PyJWT does not ignore an audience it cannot check: a token that names its recipient is rejected unless you say which recipient you are. The same message appears if `aud` has an invalid type (neither a string nor a list of strings).

Why it happens

• The verifier does not pass audience

  common

  Code written for tokens without `aud` (or copied from a minimal example) breaks as soon as the identity provider starts including `aud` — which most do for access and ID tokens. Passing the expected audience is the intended fix.

• An ID token instead of an access token

  occasional

  Some providers issue access tokens without `aud` but always put the client ID into the ID token's `aud` (Amazon Cognito is a common example). Code that works for access tokens starts failing as soon as a client sends its ID token.

• The aud claim has an invalid type

  rare

  An issuer that writes `aud` as a number, an object or a list containing non-strings produces a token PyJWT cannot match against anything.

How to fix it

1. 1.

   Tell PyJWT which audience you are

   Pass your API's identifier (or a list of acceptable identifiers). Do not switch off `verify_aud` — the check is what prevents tokens for other services from being accepted.

   claims = jwt.decode(
       token,
       signing_key,
       algorithms=["ES256"],
       audience="https://api.example.com",  # the identifier your API is registered with
   )

2. 2.

   Use unverified decoding only to inspect

   `verify_signature: False` turns off every check, including audience. It is useful to read `aud` while debugging, never to authorize a request.

   # Reading claims without trusting them (debugging, routing) - never for authorization.
   header = jwt.get_unverified_header(token)
   claims = jwt.decode(token, options={"verify_signature": False})

← Browse the full signature error database