# Auth0 django-rest-framework invalid audience inside jwt\_decode\_token method

**URL:** <https://community.auth0.com/t/auth0-django-rest-framework-invalid-audience-inside-jwt-decode-token-method/74312>\
**Category:** Get Help\
**Tags:** jwt, api, access-token, login, auth0\
**Created:** [December 6, 2021, 12:57pm UTC](https://community.auth0.com/t/auth0-django-rest-framework-invalid-audience-inside-jwt-decode-token-method/74312 "2021-12-06T12:57:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![snurfer0](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/snurfer0/32/33018_2.png) [@snurfer0](https://community.auth0.com/u/snurfer0)\
**Post date:** [December 6, 2021, 12:57pm UTC](https://community.auth0.com/t/auth0-django-rest-framework-invalid-audience-inside-jwt-decode-token-method/74312/1 "2021-12-06T12:57:23Z")

</div>

I am trying to validate the access token from the api, everything works well except token validation. The react.js and drf are running on localhost. Therefore the audience is `http://localhost/8000`.

```plaintext
def jwt_decode_token(token):
    header = jwt.get_unverified_header(token)
    jwks = requests.get('https://{}/.well-known/jwks.json'.format('domain')).json()
    public_key = None
    for jwk in jwks['keys']:
        if jwk['kid'] == header['kid']:
            public_key = jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk))

    if public_key is None:
        raise Exception('Public key not found.')

    issuer = 'https://{}/'.format('domain')
    return jwt.decode(token, public_key, audience='http://localhost/8000', issuer=issuer, algorithms=['RS256'])

```

error

```auto
jwt.exceptions.InvalidAudienceError: Invalid audience

```

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [December 6, 2021, 6:16pm UTC](https://community.auth0.com/t/auth0-django-rest-framework-invalid-audience-inside-jwt-decode-token-method/74312/3 "2021-12-06T18:16:20Z")

</div>

Hi @snurfer0,

Thanks for reaching out to the Auth0 Community!

I understand that you’ve been having trouble when trying to decode the API token, specifically with the `Invalid audience` error.

The audience should be a legitimate resource such as your API identifier or the Management API v2 identifier. Please take a look at our [Get Access Tokens](https://auth0.com/docs/security/tokens/access-tokens/get-access-tokens#control-access-token-audience) docs for more details.

In this case, you’ll need to use `https://YOUR_DOMAIN.REGION.auth0.com/api/v2/` as the audience.

I have tested this myself and could decode my API token without any issues.

Please let me know how this works for you.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 21, 2021, 6:17pm UTC](https://community.auth0.com/t/auth0-django-rest-framework-invalid-audience-inside-jwt-decode-token-method/74312/4 "2021-12-21T18:17:18Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.