# Access token issuer and unisolated domains

**URL:** <https://community.auth0.com/t/access-token-issuer-and-unisolated-domains/47148>\
**Category:** Get Help\
**Tags:** tenant\
**Created:** [July 29, 2020, 8:37pm UTC](https://community.auth0.com/t/access-token-issuer-and-unisolated-domains/47148 "2020-07-29T20:37:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ggjersund](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ggjersund/32/13175_2.png) [@ggjersund](https://community.auth0.com/u/ggjersund)\
**Post date:** [July 29, 2020, 8:37pm UTC](https://community.auth0.com/t/access-token-issuer-and-unisolated-domains/47148/1 "2020-07-29T20:37:45Z")

</div>

Based on this [question](http://community.auth0.com/t/tenants-are-not-isolated-by-domain-url/19801) I am curious as to how the issuer is determined when generating the tokens. Is it based on the domain that generates the token (e.g. https://myapp- **sandbox**.eu.auth0.com/oauth/token in the linked question, or the mapped Tenant coming from the client\_id ( https://myapp- **stage**.eu.auth0.com/oauth/token in the linked question)?

Is it sufficient to just verify the signature of the token based on the endpoint of the intended tenant (client\_id mapped tenant)? Or would I still have to check the issuer in the token?

Also, I’d like to add this would help me understand how to handle the situation with custom/multiple domains on a single tenant.

---

<div class="post-metadata">

**Author:** ![thomas.osborn](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thomas.osborn/32/22282_2.png) [@thomas.osborn](https://community.auth0.com/u/thomas.osborn)\
**Post date:** [July 30, 2020, 9:59pm UTC](https://community.auth0.com/t/access-token-issuer-and-unisolated-domains/47148/2 "2020-07-30T21:59:33Z")

</div>

Hi @ [ggjersund](http://community.auth0.com/u/ggjersund) and welcome to the community 👋

That question only applies to the client credentials flow, which is unique in that it is issuing a token based only on the client\_id and client\_secret. Therefore, it does not need for the client\_id to be for the associated domain. However, for all other flows the client\_id will have to be one mapped to the tenant.

For validating the token you should really just use a middleware that will handle the details for you. However, if you want to manually check them you’ll need to do more than just check the signature, as explained here: [Validate JSON Web Tokens](https://auth0.com/docs/tokens/guides/validate-jwts#manually-implement-the-checks)

Multiple custom domains are not currently possible, but should be possible in the future.

Hopefully that was all clear. Please let me know if you have any questions about that.