Not that it answers the original question, but:
If you specify scope=openid
, then the access_token
can be used to call the /userinfo
endpoint of the identity provider (Auth0), to get profile information about the user. If you specify an audience
, then the access_token
can be used to call the API specified in audience
. You can specify both scope=openid
and audience=xxx
, and the access token will serve for the two purposes.
access_token
s with an audience
are JWT (long format), whereas access_token
s issued without an audience
are (currently) short opaque strings.