# Audience yes, no, why?

**URL:** <https://community.auth0.com/t/audience-yes-no-why/59276>\
**Category:** Get Help\
**Tags:** opaque-tokens, jwt, access-token\
**Created:** [March 11, 2021, 3:03pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276 "2021-03-11T15:03:11Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebastian.richter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sebastian.richter/32/12977_2.png) [@sebastian.richter](https://community.auth0.com/u/sebastian.richter)\
**Post date:** [March 11, 2021, 3:03pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/1 "2021-03-11T15:03:11Z")

</div>

Hello guys,

for months now I have been using the auth0-spa-js SDK with my dev tenant and my dev application for login.

```plaintext
     await createAuth0Client({
        domain: 'my-domain',
        client_id: 'xyz012',
        audience: undefined, // remember this, it says it is optional
        redirect_uri: redirectUri,
        cacheLocation: 'memory',
        useRefreshTokens: true,
      })

```

The documentation of the SDK [https://auth0.github.io/auth0-spa-js/interfaces/auth0clientoptions.html#audience](https://auth0.github.io/auth0-spa-js/interfaces/auth0clientoptions.html#audience) says audience is optional, so setting it to `undefined` should be no problem, right? Yeah it works! I login and get a real jwt access token.

Now here is the kicker. Today I finally deployed to production using my auth0 production tenant and application. Remember audience is still `undefined`! Yeah no problem, right? Wrong! Getting unauthorized exceptions from my API now. What the frick? The reason for this is, that I now get an opaque access token in production tenant after login! Googled a bit and found this [Why is my access token not a JWT? (Opaque Token)](https://community.auth0.com/t/why-is-my-access-token-not-a-jwt-opaque-token/31028). And it says you have to send a audience to get a real jwt token, right?

So now I am totally confused why its working on one tenant without audience and on one it doesn’t.

What could be the problem? Do you have any ideas? Am I the problem?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 11, 2021, 5:30pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/3 "2021-03-11T17:30:06Z")

</div>

Hi @sebastian.richter,

It is optional, but you shouldn’t return a JWT if there isn’t a registered audience as the param.

In the application that is returning a JWT, what is the aud claim? Undefined?

---

<div class="post-metadata">

**Author:** ![jawineinger](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jawineinger/32/19028_2.png) [@jawineinger](https://community.auth0.com/u/jawineinger)\
**Post date:** [March 11, 2021, 8:19pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/4 "2021-03-11T20:19:52Z")

</div>

If you decode a JWT from your first tenant, does it have an aud claim set to anything?

Also, under your tenant settings \> General \> API Authorization Settings, there is a “Default Audience” setting. You may want to check if you have something there for your first tenant and not for your second.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 11, 2021, 8:32pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/5 "2021-03-11T20:32:29Z")

</div>

That’s a great point @jawineinger, it could be a default audience that is allowing you to get a JWT. The aud will show us what is going on.

---

<div class="post-metadata">

**Author:** ![cibrax](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/cibrax/32/27644_2.png) [@cibrax](https://community.auth0.com/u/cibrax)\
**Post date:** [March 11, 2021, 8:34pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/6 "2021-03-11T20:34:28Z")

</div>

No audience is really a bad idea. Anyone can get a token from the same Authorization Server for any other API and use it with yours. The audience is a first layer of defense against that attack.

---

<div class="post-metadata">

**Author:** ![sebastian.richter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sebastian.richter/32/12977_2.png) [@sebastian.richter](https://community.auth0.com/u/sebastian.richter)\
**Post date:** [March 12, 2021, 9:00am UTC](https://community.auth0.com/t/audience-yes-no-why/59276/7 "2021-03-12T09:00:03Z")

</div>

@jawineinger @dan.woda There you go! Indeed in my dev tenant there was a default audience set. I always forget to look in there. So all good. I was the problem :).

Final question. Am I fine using the default audience or is it better to always define the audience in my app (I just have one audience)?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 12, 2021, 4:35pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/8 "2021-03-12T16:35:29Z")

</div>

@sebastian.richter

If every access token is designated for the same API (audience) then you should be okay using the default audience.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 27, 2021, 4:36pm UTC](https://community.auth0.com/t/audience-yes-no-why/59276/9 "2021-03-27T16:36:10Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.