# Access token missing aud for userinfo endoint

**URL:** <https://community.auth0.com/t/access-token-missing-aud-for-userinfo-endoint/104988>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [April 18, 2023, 3:38pm UTC](https://community.auth0.com/t/access-token-missing-aud-for-userinfo-endoint/104988 "2023-04-18T15:38:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![connormckelvey](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/connormckelvey/32/46425_2.png) [@connormckelvey](https://community.auth0.com/u/connormckelvey)\
**Post date:** [April 18, 2023, 3:38pm UTC](https://community.auth0.com/t/access-token-missing-aud-for-userinfo-endoint/104988/1 "2023-04-18T15:38:58Z")

</div>

I have 1 tenant with 2 applications (foo-app and bar-app) and 2 APIs (foo-api and bar-api), both applications and APIs are configured basically identically with the exception of the token signing methods.

- foo-app/foo-api uses RS256
- bar-app/bar-api uses HS256

When logging in with foo-app and providing an audience of foo-api, I’m able to get an access token that has two audiences embedded

1. foo-api
2. {myDomain}/userinfo

When logging in with bar-app and providing an audience of bar-api, I’m able to get an access token, but it only includes 1 audience: bar-api.

I would like to be able to get an access token from bar-app with both audiences:

1. bar-api
2. {myDomain/userInfo}

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 18, 2023, 10:44pm UTC](https://community.auth0.com/t/access-token-missing-aud-for-userinfo-endoint/104988/3 "2023-04-18T22:44:33Z")

</div>

Hello @connormckelvey welcome to the community!

> [@connormckelvey](#):
>
> When logging in with bar-app and providing an audience of bar-api, I’m able to get an access token, but it only includes 1 audience: bar-api.
> 
> I would like to be able to get an access token from bar-app with both audiences:
> 
> 1. bar-api
> 2. {myDomain/userInfo}

This is expected behavior - Tokens signed HS256 will not include the `/userinfo` audience, only RS256 will. [Userinfo](https://auth0.com/docs/api/authentication#get-user-info) will accept [opaque access tokens](https://auth0.com/docs/secure/tokens/access-tokens#opaque-access-tokens) and RS256 tokens with the `userinfo` audience.

Hope this helps to clarify!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 2, 2023, 10:46pm UTC](https://community.auth0.com/t/access-token-missing-aud-for-userinfo-endoint/104988/5 "2023-05-02T22:46:40Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.