AccessToken appears to be invalid

[mdebruin93]

Hello,

I’ve used the quickstart scenario for SPA + API. However, my access token remains invalid (according to jwt.io) and therefor my API is also throwing Unauthorized exceptions.

This is my initialization of AuthWeb:
final Auth0Web _auth0web = Auth0Web(“My-Auth0Domain”, “My-Auth0ClientId”);

    return await _auth0web.loginWithRedirect(
      audience: "http://localhost:7145/", // const String.fromEnvironment("auth0audience"),
      redirectUrl: "http://localhost:3000",
    );

Is there any configuration issue possible in my Application configuration that could cause an invalid access token?
I’m using Flutter SDK: auth0_flutter: ^1.5.0.

Hoping on some guidance on what I could possible have done wrong.

[tyf]

Hey there @mdebruin93 !

Sorry for the delayed response here - Were you ever able to get this sorted? If not, do you mind sharing the specific quickstart? Also, when inspecting network requests do you see the audience param being passed in the initial request to /authorize?

[mdebruin93]

Hey There @tyf ,

I haven’t found a solution yet, unfortunately.
I do see the audience parameter in the initial request.

[tyf]

Thanks for confirming - I am almost positive it is related to this issue:

loginWithRedriect with audience set returns wrong access token

If you specify the audience param in onLoad, you should then get a valid JWT like you are expecting. In the sample app it looks like:

@override
  void initState() {
    super.initState();
    auth0 = widget.auth0 ??
        Auth0(dotenv.env['AUTH0_DOMAIN']!, dotenv.env['AUTH0_CLIENT_ID']!);
    auth0Web =
        Auth0Web(dotenv.env['AUTH0_DOMAIN']!, dotenv.env['AUTH0_CLIENT_ID']!);

    if (kIsWeb) {
      auth0Web.onLoad(audience: 'https://test-api-endpoint').then((final credentials) => setState(() {
            _user = credentials?.user;
            
            print(credentials!.accessToken);
          }));
    }
  }

[mdebruin93]

Hey @tyf ,

Thank you for your response. That indeed fixed my issue.
I do still think, however, that you should update your documentation.
Also, the scenario of SPA + API seems to be outdated as this still points to rules whereas, according to the dashboard, this is deprecated in favor of actions.

[tyf]

Awesome, thanks for confirming! Agreed, always appreciate the feedback