Steps to Reproduce:
- Create a SPA client using the
POST /api/v2/clients
API with the following payload:
{
"name": "clientApiTest",
"app_type": "spa"
}
Response will not show any specific value for jwt_configuration.alg
:
"jwt_configuration": {
"lifetime_in_seconds": 36000,
"secret_encoded": false
}
-
View the client in the Admin portal under Applicaitons, scroll down to Advanced > OAuth section. The "JSON Web Token (JWT) Signature Algorithm) dropdown will show RS256
-
Use one of Auth0’s SDKs to complete an OAuth flow for the client. The returned JWT will be signed with HS256 even though the Admin Portal says RS256.
The client can be set to RS256 either with a Management API call to PATCH /api/v2/clients/:id
or by using the Admin Portal to set it to HS256, save, then set back to RS256 and save again, but the expectation is that if it’s truly set to HS256 by default the Admin Portal would not say it’s RS256!