Access token created using Expo client is unsigned

JWT.io
, , ,
1

I followed the guide here successfully and received an access token. The only change I had to make was to pass in an audience parameter to authorize(). Auth0 Expo SDK Quickstarts: Login

However, the access token I get doesn’t appear to be signed as when I try to verify it using the secret key found at:

Applications → My App → Settings tab → Advanced Settings → Certificates → Signing Certificate

It fails to verify it. Weird part is that the right access token is generated when I use the express-openid-connect method using my Express app, where I specify the following:

auth({
    idpLogout: true,
    issuerBaseURL: process.env.AUTH0_ISSUER_BASE_URL,
    baseURL: process.env.BASE_URL,
    clientID: process.env.AUTH0_CLIENT_ID,
    secret: process.env.SESSION_SECRET,
    clientSecret: process.env.AUTH0_CLIENT_SECRET,
    authRequired: false,
    auth0Logout: true,
    idTokenSigningAlg: "RS256",
    authorizationParams: {
      scope: "openid profile email",
      response_type: "code",
      response_mode: "form_post",
      audience: "punchline/api",
    },
  });

I obviously can’t pass things like process.env.AUTH0_CLIENT_SECRET from my iOS app as secrets shouldn’t be stored on the client side, but I’m wondering why the properly signed access token is generated with express-openid-connect, but fails using Expo.